Google says half of all zero-days it tracked in 2025 targeted buggy enterprise tech

A recent analysis by Google has revealed a concerning trend in cybersecurity, highlighting that nearly half of the zero-day vulnerabilities tracked last year were aimed at enterprise technology. This alarming statistic underscores the evolving tactics of cybercriminals, who are increasingly targeting large organizations in their quest to steal sensitive information. According to Google's annual report, a striking 48% of the zero-day vulnerabilities—flaws in software that remain unknown to developers at the time of exploitation—were associated with technologies utilized by major corporations. Alarmingly, many of these vulnerabilities affected the very devices intended to safeguard enterprise networks from cyber threats. Prominent security and networking solutions, including firewalls from industry leaders like Cisco and Fortinet, alongside VPN and virtualization platforms from Ivanti and VMware, were identified as prime targets. Representatives from these four companies confirmed that they have witnessed hackers exploiting their products on customer networks in recent months. Google's researchers pointed out that common vulnerabilities, such as issues with input validation and incomplete authorization processes, have allowed cybercriminals to bypass firewall and VPN protections, gaining unauthorized access to corporate networks. These types of bugs are typically easier for hackers to exploit, although they usually necessitate software updates for remediation. The report also shed light on a significant campaign by the Clop extortion gang, which targeted customers of Oracle E-Business Suite. This breach reportedly led to the theft of extensive human resources data from various organizations, including notable entities like Harvard University and the American Airlines subsidiary, Envoy. While 48% of the zero-days were linked to enterprise technology, the remaining 52% were found in consumer products, such as software from Microsoft, Google, and Apple. Notably, a rise in zero-days was observed within mobile devices, indicating an increasing vulnerability in consumer technology as well. Furthermore, Google noted a shift in the landscape of cyber threats, attributing more zero-days to surveillance vendors rather than conventional government-backed espionage groups. These surveillance vendors, often involved in developing spyware and exploits, are now actively engaged in hacking on behalf of governmental entities, representing a significant change in how access to hacking tools is sought by governments.