<h1>Overview of 2025 Zero-Day Vulnerabilities</h1>
<p>2025 saw a significant number of zero-day vulnerabilities being actively exploited in the wild, according to the Google Threat Intelligence Group (GTIG). The group tracked 90 such vulnerabilities, which marks an increase from the 78 recorded in 2024 but remains below the peak of 100 in 2023. A notable shift was observed with nearly half (48%) of these zero-days targeting enterprise technologies, an all-time high for this category.</p>
<h1>Targeted Enterprise Technologies</h1>
<p>Security and networking appliances, such as firewalls from Cisco and Fortinet, as well as VPN and virtualization platforms like those from Ivanti and VMware, emerged as prime targets. The vulnerabilities often exploited included common flaws like input validation issues and incomplete authorization processes. The Clop extortion gang’s attack on Oracle E-Business Suite, which led to the theft of HR data from numerous organizations, including Harvard and American Airlines, highlights the risks.</p>
<h1>Shift in Attribution</h1>
<p>For the first time, more zero-days were attributed to commercial surveillance vendors (CSVs) than to traditional state-sponsored groups. Vendors such as NSO Group and Intellexa led this trend, while Chinese (PRC) state-sponsored groups remained prominent, reportedly responsible for 10 zero-days. Their focus was mainly on exploiting enterprise technology, stressing an espionage-related motive in many instances.</p>
<h1>Consumer Product Vulnerabilities</h1>
<p>Beyond enterprise targets, consumer products from tech giants such as Microsoft, Google, and Apple also witnessed significant exploit activities. Although receiving less attention than enterprise technologies, these consumer-focused zero-days still represented a substantial portion (52%) of all tracked vulnerabilities.</p>
<h1>Key Exploits and Technical Highlights</h1>
<p>A few standout exploits from the report include:</p>
<ul>
<li>Browser sandbox escapes targeting OS and GPU components.</li>
<li>A SonicWall full-chain exploit.</li>
<li>Samsung DNG image parsing vulnerabilities.</li>
</ul>
<p>These technical areas reflect ongoing innovation in attack vectors that exploit both software and hardware weaknesses.</p>
<h1>Anticipated Impact of AI on Cybersecurity</h1>
<p>Looking forward, the report anticipates that AI will both empower attackers and defenders in 2026, potentially accelerating the lifecycle of vulnerability exploitation and patching. The BRICKSTORM campaign’s IP theft is highlighted as a case enabling long-term zero-day development, posing challenges to future cyber defense strategies.</p>
<h1>Recommendations for Defense</h1>
<p>The report outlines several defensive measures to protect against zero-day attacks, including:</p>
<ul>
<li>Architectural hardening and network segmentation.</li>
<li>Implementation of behavioral monitoring and least-privilege access models.</li>
<li>Establishment of emergency patching processes and real-time asset inventories.</li>
<li>Adoption of software bills of materials to track and manage exposures.</li>
</ul>
<p>These strategies aim to bolster both infrastructure and personal device security, mitigating the impact of potential zero-day exploits in the future.</p>


Collections

Google Threat Intelligence Group tracked 90 actively exploited zero-day vulnerabilities in 2025, up from 78 in 2024. A record 48% targeted enterprise technologies including firewalls, VPNs, and virtualization platforms from Cisco, Fortinet, Ivanti, and VMware. For the first time, commercial surveillance vendors like NSO Group and Intellexa were attributed more zero-days than traditional state-sponsored actors, though Chinese state groups still accounted for 10 exploits. Notable incidents include the Clop gang's attack on Oracle E-Business Suite and browser sandbox escapes targeting OS and GPU components. The report anticipates AI will accelerate both attack and defense cycles in 2026, and recommends architectural hardening, network segmentation, behavioral monitoring, least-privilege access, and software bills of materials as defensive measures.

2025 Zero-Day Vulnerabilities: An Alarming Rise in Enterprise Targeting