The enterprise zero-day vulnerability surge is no longer a trend to watch - it is an active operational crisis. Google Threat Intelligence Group tracked 90 zero-day vulnerabilities exploited in the wild in 2025, a 15% increase over 2024, and for the first time nearly half of all tracked exploitation targeted enterprise technology rather than consumer platforms. CIOs and CISOs are being asked to defend infrastructure against attacks that arrive, on average, seven days before any patch or advisory exists.
Source: Google Threat Intelligence Group annual review, March 2026; Bright Defense zero-day statistics
| Value (vulnerabilities) | Zero-days exploited |
|---|---|
| 2023 | 70 vulnerabilities |
| 2024 | 78 vulnerabilities |
| 2025 | 90 vulnerabilities |
Record exploitation rates and what the numbers actually mean
Google GTIG's annual review, published March 10, 2026, confirmed 90 zero-days actively exploited in 2025, up from roughly 78 in 2024 and about 70 in 2023. The headline number matters less than the composition: 48% of those vulnerabilities targeted enterprise technologies, the highest share GTIG has ever recorded. Operating systems remained the single largest exploited category at 44% of all zero-days, but browsers - long the default boogeyman for enterprise patching teams - accounted for less than 10%.
The shift signals a deliberate strategic pivot by threat actors. Consumer-facing attack surfaces are well-instrumented and patched quickly. Enterprise infrastructure - networking appliances, edge devices, security software itself - is often less monitored, updated on maintenance windows, and deeply trusted by the rest of the network. Attackers have clearly noticed.
Attackers exploited vulnerabilities an average of seven days before public disclosure in 2025 - turning the patch window negative and making compensating controls a necessity, not a backup plan.
Networking and security gear is the primary target now
Of the enterprise-focused zero-days in 2025, security and networking vulnerabilities accounted for roughly 21 cases. Fourteen of the year's exploited zero-days specifically targeted edge devices - the firewalls, VPN concentrators, and secure access gateways that sit at the perimeter of most enterprise networks. Barracuda Networks flagged in March 2026 that half of all enterprise-targeted zero-days fell in this networking and security software category.
The practical implication is severe. A compromised edge device does not give an attacker a foothold in a single endpoint - it can expose traffic inspection, authentication flows, and lateral movement paths across the entire organization. Security teams have historically treated these appliances as trusted infrastructure. That trust is now an active liability.
A concrete illustration came in late March 2026, when watchTowr's sensors identified active exploitation of a Fortinet FortiClient EMS vulnerability, tracked as CVE-2026-35616, on March 31 - before Fortinet published its own advisory. Attackers were already inside affected environments at the moment defenders learned the vulnerability existed.
The patching model has already failed this threat class
The mean time to exploit in 2025 turned negative. Attackers exploited vulnerabilities an average of seven days before they were publicly disclosed, according to GTIG's data. The traditional patch-and-wait workflow assumes defenders have a window between vendor disclosure and active exploitation. That window is now inverted.
March 2026's Patch Tuesday illustrates how this plays out in practice. Microsoft released updates for 79 flaws, including two publicly disclosed zero-days. Also included was a SQL Server elevation-of-privilege vulnerability, CVE-2026-21262, carrying a CVSS score of 8.8. That flaw allows a logged-in user to quietly escalate privileges and potentially reach full database administrator access - the kind of quiet, high-value movement that detection tools tuned to perimeter threats tend to miss.
Security leaders who measure success by patch deployment speed are measuring the wrong thing for this threat class. Compensating controls that function before a patch exists are now table stakes, not aspirational best practice.
What IT leaders need to do when no patch exists
GTIG, Barracuda, and Critical Start all point to a consistent set of compensating controls for environments where patches are unavailable or not yet deployed. Network segmentation limits the blast radius of a compromised edge device. Privileged access management reduces the damage of credential theft and stops the kind of quiet privilege escalation CVE-2026-21262 enables. Behavioral detection - looking for anomalous lateral movement and unusual process execution rather than known-bad signatures - can surface exploitation activity that occurs before any CVE is assigned.
For CISOs, the immediate priority should be an audit of edge devices and security appliances: what is their current patch currency, who can access their management interfaces, and what would a full compromise of each device enable? For CIOs, the conversation with the board needs to shift from patch compliance percentages to mean time to detect and contain on unpatched infrastructure. The 2025 data makes clear that one number without the other is no longer sufficient.
