Vulnerabilities · 193 days ago
Google's Threat Intelligence Group tracked 90 zero-day vulnerabilities exploited in 2025. About 48% targeted enterprise technologies such as firewalls, VPNs and virtualization platforms. Attribution shows state-backed groups focused on edge and security appliances while commercial surveillance vendors targeted mobile devices and browsers.
CVEs in this update
19 CVEs
Across Connect Secure, Policy Secure, Neurons for ZTA gateways, and related packages.
4 critical · 13 high · 2 medium · 0 low
19 in CISA KEV · 17 with EPSS above 1%
1 with functional or packaged public exploit code
Highest severity: CVE-2025-43300 · 10.0 CRITICAL
Highest EPSS: CVE-2025-0282 · 100%
Showing the top 10 by KEV, EPSS, and severity.
7 sources covering this story
Zero‑Day Attacks on Enterprise Software Reach Record High
Almost a quarter of the zero days detected by Google in 2025 targeted security and networking appliances
Nearly half of exploited zero-day flaws target enterprise-grade technology
A report by Google Threat Intelligence Group warns that AI will be used to speed and scale attacks in 2026.
Google says half of all zero-days it tracked in 2025 targeted buggy enterprise tech | TechCrunch
Enterprise software was a major focus of zero-day activity during 2025, with security and networking devices, like firewalls, VPNs, and virtualization platforms among the most targeted by malicious hackers.
Google: Half of 2025’s 90 Exploited Zero-Days Aimed at Enterprises
Less than half of the total zero-days have been attributed to a threat actor, but spyware vendors and China are in the lead.
The Record from Recorded Future
Google says 90 zero-days exploited in 2025 as commercial vendor activity grows
Google Threat Intelligence Group said it tracked 90 zero-day vulnerabilities that were exploited by a variety of actors last year, surpassing the 78 that were used by threat actors in 2024.
Look What You Made Us Patch: 2025 Zero-Days in Review | Google Cloud Blog
Our analysis of 90 zero-day vulnerabilities tracked in 2025, focusing on techniques and how AI will accelerate the vulnerability landscape.
Google says 90 zero-days were exploited in attacks last year
Google Threat Intelligence Group (GTIG) tracked 90 zero-day vulnerabilities actively exploited throughout 2025, almost half of them in enterprise software and appliances.
Part of the PlainSec briefing for 2026-03-07