Google Reports 90 Zero-Day Exploits in 2025: Enterprise Software Under Siege

The cybersecurity landscape in 2025 was defined by a relentless pursuit of zero-day vulnerabilities, with the Google Threat Intelligence Group (GTIG) documenting 90 such flaws exploited in active attacks. This volume underscores a persistent reality: despite advancements in secure coding and automated testing, sophisticated adversaries continue to find and weaponize unknown gaps in software at a steady clip. The most alarming trend within this data is the pivot toward enterprise software and edge appliances, which accounted for nearly half of the year's zero-day activity. This shift marks a strategic evolution for both state-sponsored actors and high-tier cybercriminal syndicates who are moving away from the well-defended consumer perimeter.

Enterprise appliances, such as VPN gateways, firewalls, and load balancers, have become the preferred entry point for modern threat actors. These devices often sit outside the traditional security stack, frequently lacking the endpoint detection and response (EDR) capabilities that protect workstations and servers. Because they operate with high privileges and provide direct access to internal networks, a single zero-day in an edge appliance can grant an attacker 'god-mode' access to an entire organization. Google’s findings suggest that attackers are increasingly investing in the research required to break these specialized systems, recognizing that the lack of visibility on these platforms allows for longer dwell times and more effective lateral movement.

“

The cybersecurity landscape in 2025 was defined by a relentless pursuit of zero-day vulnerabilities, with the Google Threat Intelligence Group (GTIG) documenting 90 such flaws exploited in active attacks.

This trend also reflects the maturing defensive posture of consumer platforms like Chrome and Android. While these remain targets, the 'cost per exploit' has risen significantly due to sandboxing, memory safety improvements, and rapid patching cycles. In contrast, the enterprise sector often struggles with a 'patching gap'—the time between a vendor releasing a fix and an organization deploying it across a complex, global infrastructure. For attackers, the ROI on an enterprise zero-day is currently higher than a consumer-facing one, as it facilitates high-stakes corporate espionage and large-scale ransomware operations.