Overview
Zero-day vulnerabilities represent unpatched security flaws unknown to software vendors at the time of exploitation. According to Google Threat Intelligence Group's 2025 analysis, attackers exploited 90 zero-day vulnerabilities in-the-wild during 2025—higher than 2024's 78 but slightly lower than 2023's record 100 exploitations.
The term "zero-day" derives from the number of days vendors have known about a vulnerability: zero. Once exploitation begins, developers face immediate pressure to develop and release patches before widespread compromise occurs.
Key Threats
Enterprise-Focused Exploitation Surge
In a structural shift identified in 2024 and intensified in 2025, enterprise technologies became primary targets. Google's report documents that 43 zero-days (48% of total) impacted enterprise systems—an all-time high. This represents a departure from historical patterns favoring consumer-facing applications.
Browser Exploitation Decline
Contrary to previous trends, browser-based zero-day exploitation fell to historical lows in 2025, while operating system vulnerabilities saw increased abuse.
State-Sponsored Targeting Patterns
State-sponsored espionage groups continue prioritizing edge devices and security appliances as primary network entry points, with just over 50% of attributed state-sponsored zero-day exploitation targeting these technologies. Historical data shows:
- 2021: Mandiant identified 80 zero-days exploited in-the-wild, more than double 2019's previous record
- Chinese cyber espionage groups: Exploited eight zero-days in 2021 alone, representing the highest national total
- Stuxnet (2010): Leveraged four zero-day vulnerabilities to compromise Iranian nuclear centrifuges
- Dridex banking Trojan (2017): Distributed via zero-day vulnerability exploitation
Notable CVEs Actively Exploited (2025)
CVE-2025-21590, CVE-2025-40602, CVE-2025-21042, CVE-2025-2783, CVE-2025-38352, CVE-2025-43300, CVE-2025-8088, CVE-2025-27038, CVE-2025-6558, CVE-2025-61882, CVE-2025-5419, CVE-2025-48543, CVE-2025-14174, CVE-2025-23006, CVE-2025-21043, CVE-2025-61884, and CVE-2025-0282.
Notable Incidents
Chrome Type-Confusion Vulnerability (2022)
Google Chrome experienced active exploitation of CVE-2022-1096, a type-confusion vulnerability in the V8 JavaScript Engine affecting Chrome and Chromium-based browsers (Microsoft Edge, Opera, Vivaldi, Brave). This followed earlier patching of CVE-2022-0609 on February 14, 2022.
Apple macOS Unpatched Zero-Days (April 2022)
Apple patched two actively exploited zero-days (CVE-2022-22675, CVE-2022-22674) for macOS Monterey on March 31, 2022, but failed to release corresponding updates for Big Sur and Catalina versions—leaving an estimated 35-40% of supported Macs vulnerable despite Apple's historical practice of patching two previous OS versions simultaneously.
Healthcare Sector Warnings (November 2021)
The HHS' Health Sector Cybersecurity Coordination Center (HC3) issued threat briefs warning of increased financially motivated zero-day attacks targeting healthcare and public health sectors, noting that zero-day vulnerabilities are exploited across all industry sectors.
Buckeye/Equation Group Tools (2016-2018)
The Buckeye espionage group exploited a previously unknown Windows zero-day vulnerability (reported to Microsoft September 2018, patched March 2019) alongside Equation Group tools at least one year before the Shadow Brokers leak, demonstrating sustained zero-day exploitation campaigns.
Exploitation Timeline Analysis
Research from 2018-2019 vulnerability data shows the majority of exploitations occur before patch release or within days of patch availability. More than 25% of vulnerabilities were exploited within one month after patch release—indicating attackers' rapid identification and weaponization capabilities.
Recommendations
Immediate Actions
- Prioritize enterprise system patching: Given the 48% concentration of zero-day exploitation targeting enterprise technologies, establish expedited patch deployment processes for critical infrastructure, edge devices, and security appliances.
- Monitor for in-the-wild exploitation: Implement threat intelligence feeds tracking zero-day disclosures and active exploitation indicators across your technology stack.
- Apply compensating controls: For systems where immediate patching is impossible, deploy network segmentation, enhanced monitoring, and behavioral analytics to detect exploitation attempts.
Strategic Measures
- Establish vulnerability management hierarchy: Prioritize vulnerabilities in technologies matching your enterprise architecture and threat model, focusing on edge devices and security appliances.
- Implement heuristic-based detection: Deploy antivirus and endpoint detection systems utilizing behavior-tracking algorithms and heuristics, as these can detect zero-day exploits even without signature availability.
- Engage bug-bounty programs: Proactively discover vulnerabilities before attackers by implementing coordinated vulnerability disclosure and bug-bounty initiatives.
- Maintain vendor accountability: Track vendor patch timelines; note that Apple's failure to patch Big Sur/Catalina for 7+ days represents unacceptable risk exposure inconsistent with historical practices.
- Monitor state-sponsored activity: Given that state-sponsored groups exploit zero-days targeting edge/security appliances, apply heightened scrutiny to these perimeter technologies through threat intelligence sharing.
Long-Term Resilience
- Assume breach mentality: Zero-day exploitation bypasses traditional user-interaction-dependent defenses; assume advanced adversaries can compromise systems directly through OS and software flaws.
- Diversify tooling: Reduce reliance on single-vendor ecosystems; the concentration of zero-days in Chrome and related technologies demonstrates risks of monoculture environments.
Source: CyberBriefing intelligence synthesis from 20 years of historical threat data.