Google: 43 of 90 Zero-Days Exploited in 2025 Affected Enterprise Technology
Summary
Google says 90 zero-days were exploited in 2025, including 43 affecting enterprise technology—an all-time high. Commercial surveillance vendors accounted for 15 attributed exploits, while operating systems remained the most targeted category.
Key points
- Google tracked 90 zero-days exploited in the wild in 2025, compared with 78 in 2024 and 100 in 2023.
- Forty-three vulnerabilities affected enterprise technology, an all-time high; many attacks targeted networking and cybersecurity appliances for initial access.
- Operating systems accounted for 44% of zero-days, up from 40% in 2024; mobile zero-days rose from 9 to 15.
- Google attributed 42 zero-days to threat actors; commercial surveillance vendors accounted for 15, with three more flaws considered likely linked to them.
- State-sponsored cyberespionage groups accounted for 12 zero-days, with three additional flaws believed to fit that category; Google said PRC-nexus groups remained the most prolific state sponsors.
- Google expects threat actors to use AI to accelerate vulnerability discovery and exploit development, while defenders may use it to find vulnerabilities proactively.
Article Details
- Publisher
- Google Threat Intelligence Group (GTIG)
- Report Period
- 2025
- Scope
- Zero-day vulnerabilities exploited in the wild, attribution, and targeting trends
- Sample Size
- 90 zero-day vulnerabilities tracked as exploited in the wild in 2025
- Key Statistics
- GTIG tracked 90 zero-days exploited in the wild in 2025.
- 43 of the 90 zero-days affected enterprise technologies.
- 42 of the 90 zero-days were attributed to a threat actor.
- Commercial surveillance vendors exploited 15 vulnerabilities; three additional flaws were marked as likely associated with commercial surveillance vendors.
- State-sponsored cyberespionage groups accounted for 12 zero-days; three additional vulnerabilities were believed to be in this category.
Threat Actors
ARMORY CASTLEGoogle identified UNC5221 as a PRC-nexus group that continued to focus on security appliances and edge devices to maintain persistent access to strategic targets.UNC3886Google identified UNC3886 as a PRC-nexus group that continued to focus on security appliances and edge devices to maintain persistent access to strategic targets.
Vendors
AppleIn 2025, Microsoft accounted for 25 of the zero-days, followed by Google (11), Apple (8), and Cisco (4).CiscoIn 2025, Microsoft accounted for 25 of the zero-days, followed by Google (11), Apple (8), and Cisco (4).GoogleGoogle’s Threat Intelligence Group (GTIG) reported on Thursday that 90 zero-day vulnerabilities were exploited in the wild in 2025, and an increasing percentage were aimed at enterprises.MicrosoftIn 2025, Microsoft accounted for 25 of the zero-days, followed by Google (11), Apple (8), and Cisco (4).