Rapid7's quarterly threat report, published Oct 20, tracked 43 newly exploited high- and critical-severity vulnerabilities in Q3. That is down 7% from Q2 but up 19% year over year.

• Average time from public disclosure to exploitation: 3 days. 71% were exploited within 7 days, 80% within 14 and 90% within 30.
• 34 of 43 (79%) needed no authentication or user interaction.
• 8% of the threat reporting Rapid7 tracked described AI as an operational part of attacks, used for technique selection, target assessment and recovering from failed steps, with humans still choosing targets. It also notes attackers splitting malicious tasks across several AI sessions to get past provider safeguards.
• Underground forum monitoring found 41 posts selling RDP or network access.

The practical point: monthly patch windows are slower than the typical exploit. Fast-track anything that is internet-facing, reachable without login and known to be exploited. A CVSS score alone won't sort that for you.