Security Report · raw.githubusercontent.com

VulnCheck Report Highlights Rapid Exploitation and Ransomware Zero-Day Use in 2025

Oct 21, 2026 · Original Report (PDF) ↗

Report discovered via Awesome Annual Security Reports.

Summary

VulnCheck identified 884 CVEs with first-time exploitation evidence in 2025; 28.96% were exploited on or before CVE publication. Its annual report also highlights ransomware zero-days and growing volumes of unreliable AI-generated exploit code.

Key points

Drawing on more than two dozen indices and over 500 sources, VulnCheck identified 884 CVEs with first-time exploitation evidence in 2025; 28.96% were exploited on or before their CVE publication date.
The report tracked more than 14,400 exploits for 2025 CVEs, up 16.5% year over year, and warned that AI-generated, nonfunctional or misleading code undermines public repository reliability.
Of 39 vulnerabilities disclosed in 2025 with known ransomware exploitation, 56.4% were discovered through zero-day exploitation. One-third still lacked public or commercial exploits as of January 2026.
React2Shell, CVE-2025-55182, accumulated 236 valid public exploits during the final four weeks of 2025. Four SharePoint ToolShell vulnerabilities were exploited at scale beginning in July.
VulnCheck observed a 52% year-over-year increase in China-nexus threat actor attributions, while the number of new vulnerabilities linked to state-sponsored groups fell 13%.
The report examines Cl0p's Oracle E-Business Suite campaign, highlighting uncertainty over how observed exploit chains map to CVE-2025-61882 and CVE-2025-61884.
Botnet exploitation of current-year CVEs fell 53%, but RondoDox continued incorporating older and newer public exploits, illustrating that delayed exploitation remains a remediation risk.

Article Details

Publisher: VulnCheck
Report Period: 2025, with selected observations through January 2026
Scope: Vulnerability exploitation, public exploit availability, threat actor attribution, ransomware, and botnet activity.
Sample Size: More than two dozen VulnCheck indices and 500+ sources; 884 CVEs with first-time exploitation evidence from 118 unique sources.
Key Statistics: VulnCheck identified 884 CVEs with first-time exploitation evidence in 2025; 28.96% were exploited on or before their CVE publication date.
More than 14,400 exploits for 2025 CVEs were identified, a 16.5% year-over-year increase. More than 98% of tracked exploits were proof-of-concept code rather than fully weaponized exploits.
Among 39 CVEs disclosed in 2025 with known ransomware exploitation, 56.4% were discovered through zero-day exploitation. One-third had no public or commercial exploit available as of January 2026.
There were 52 CVEs from 2025 with named threat actor attribution; China-nexus threat actor attributions increased 52% year over year.
VulnCheck tracked 23 CVEs with 2025 identifiers exploited by botnets, representing a reported 53% decline in botnet activity across recent CVEs.
Recommendations: Prioritize vulnerability remediation using confirmed in-the-wild exploitation, exploit maturity, and attacker behavior rather than vulnerability volume alone.
Validate public proof-of-concept code rather than treating repository publication as authoritative evidence of a functioning exploit.
Continue prioritizing older exposed vulnerabilities for remediation; delayed exploitation does not imply reduced risk.
Treat ransomware leak-site posts as an imperfect activity metric rather than confirmation of incidents or evidence that a group is dormant.