Google Reports 90 Zero-Day Exploits in 2025: Enterprise Software at Risk

The release of the 2025 zero-day exploitation report by the Google Threat Intelligence Group (GTIG) marks a critical inflection point in the global cybersecurity landscape. With 90 separate zero-day vulnerabilities actively exploited in the wild last year, the sheer volume of discovery highlights a threat environment that is both highly sophisticated and exceptionally well-resourced. For the SaaS and Cloud sectors, the most significant takeaway is not just the quantity of these exploits, but their specific distribution: nearly 50% of the identified zero-days targeted enterprise software and appliances, such as VPNs, firewalls, and mail servers, rather than traditional consumer-facing endpoints like browsers or mobile operating systems.

This strategic shift toward enterprise infrastructure reflects a tactical evolution among both state-sponsored actors and high-tier cybercriminal groups. By targeting edge devices and core business applications, attackers are able to gain a persistent foothold that facilitates lateral movement across corporate networks, often while bypassing traditional perimeter defenses. This 'living off the edge' strategy is particularly effective because enterprise appliances are frequently difficult to monitor and often do not support the same level of endpoint detection and response (EDR) or forensic logging as standard workstations or cloud-native workloads. The GTIG report suggests that while memory safety improvements and sandboxing in consumer software are making those targets increasingly difficult to compromise, the enterprise software ecosystem has not yet reached a comparable level of security maturity, leaving it as the path of least resistance for advanced persistent threats (APTs).

“

The release of the 2025 zero-day exploitation report by the Google Threat Intelligence Group (GTIG) marks a critical inflection point in the global cybersecurity landscape.

For SaaS providers and cloud infrastructure operators, the implications of this trend are profound. The infrastructure supporting modern cloud services is itself a primary target; a single zero-day in a widely used virtualization layer, identity provider, or load balancer could have catastrophic cascading effects across thousands of downstream customers. As attackers move further up the technology stack, the security of the application layer and the underlying management plane becomes the primary battleground. This necessitates a move away from reactive patching toward a 'secure by design' philosophy. SaaS vendors are under increasing pressure to demonstrate that their platforms are built on hardened, memory-safe foundations and that they maintain rigorous control over the third-party appliances and libraries integrated into their environments.