Zero-day exploits surge 15% in 2025, threatening enterprises

A staggering 90 zero-day vulnerabilities were actively exploited in 2025, a 15% jump from 2024, according to a Google Threat Intelligence Group report. This isn't just an incremental increase; it’s a clear escalation in the cybersecurity arms race.

Remote code execution flaws lead the charge

Zero-day vulnerabilities, flaws unknown to vendors and without patches, are prized by cybercriminals for their ability to grant initial system access, execute remote code, or escalate privileges. The report details that 47 of the 90 exploited vulnerabilities targeted end-user platforms, while 43 focused on enterprise products. Among the most prevalent flaw types were remote code execution, injection errors, deserialization failures, authorization bypasses, and memory corruption issues.

Memory safety vulnerabilities accounted for roughly 35% of all exploited zero-days last year. Businesses faced a particularly intense barrage, with security devices, network infrastructure, virtualization platforms, and VPN services being prime targets. These systems offer attackers a direct pathway into corporate networks.

Operating systems remained the most frequently targeted, with 24 zero-day exploits hitting desktop systems and 15 impacting mobile platforms. Interestingly, web browser exploits declined to just eight cases – a notable drop from previous years. Microsoft was the most targeted vendor, with 25 vulnerabilities exploited, followed by Google (11) and Apple (8).

The rise of artificial intelligence could further accelerate the discovery and exploitation of these weaknesses. The report anticipates a continuation of high-volume zero-day attacks in 2026. The sheer volume of these attacks highlights a fundamental shift: proactive security measures are no longer optional; they are a matter of survival.

The increasing sophistication of exploit development, coupled with the potential for AI-driven discovery, presents a formidable challenge. Organizations must move beyond reactive patching and embrace a layered security approach that prioritizes vulnerability management and threat hunting. The cost of inaction will only escalate.