Google says half of all zero-days it tracked in 2025 targeted buggy enterprise tech

Google's annual threat intelligence report reveals that 48% of zero-day vulnerabilities tracked in 2025 targeted enterprise technologies, a new high. Security and networking devices—including firewalls from Cisco and Fortinet, and VPN/virtualization platforms like Ivanti and VMware—were among the most targeted. Common flaws such as input validation issues and incomplete authorization were frequently exploited. The Clop extortion gang's campaign against Oracle E-Business Suite also contributed, stealing HR data from dozens of organizations including Harvard and American Airlines. The remaining 52% of zero-days hit consumer products from Microsoft, Google, and Apple. Google also noted a growing attribution of zero-days to commercial surveillance vendors rather than traditional state-sponsored groups.