The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Google Threat Intelligence Group (GTIG) tracked 90 zero-day vulnerabilities exploited in the wild in 2025. Forty-three—48%, or just under half—affected enterprise software and appliances, an all-time high in both count and share in GTIG’s tracked series. The figures come from its report published March 5, 2026, and describe vulnerabilities, not a count of individual attacks or victims. GTIG’s 2025 Zero-Day Review provides the full breakdown.
What Google counted as a zero-day
GTIG defines a zero-day as “a vulnerability that was maliciously exploited in the wild before a patch was made publicly available.” Its 2025 analysis covers vulnerabilities disclosed during 2025, with a data cutoff of Dec. 31, 2025. GTIG says patches are available for all zero-days included in the dataset.
The report combines GTIG’s original research with reliable open-source reporting, but the group says it cannot independently confirm every report. Its dataset may change as investigators uncover past incidents, and it may not capture all exploitation. The counts therefore describe GTIG’s tracked and reported cases, not a complete census of zero-day activity.
Enterprise products accounted for 43 vulnerabilities
GTIG classified 43 of the 90 vulnerabilities—48%—as affecting enterprise software and appliances. The category covers technology mainly used by businesses or in business environments. In its review of 2024, GTIG reported 36 enterprise zero-days, or 46% of that year’s tracked total. The latest report calls the 2025 enterprise count and share all-time highs in its tracked series.
#1 Best Overall
- INTEGRATED FIREWALL APPLIANCE AND SECURITY SERVICES: Comes with FortiGate-40F Firewall Appliance, 1 year of FortiCare Premium, and FortiGuard Unified Threat Protection.
- UTP SECURITY FEATURES: Offers protection from advanced threats with DNS filtering, URL filtering, video filtering, and controls against botnets.
- IDEAL FOR SMALLER SETTINGS: Best suited for small to mid-sized businesses needing reliable security without the complexity of larger systems.
- CONTINUOUS SUPPORT AND MAINTENANCE: FortiCare Premium ensures that technical help is readily available to manage and troubleshoot issues.
- COMPACT AND EFFECTIVE: Provides a powerful, yet compact security solution that effectively protects against a wide range of cyber threats.
Security, networking and edge devices
Twenty-one of the enterprise vulnerabilities affected security and networking products. GTIG identified 14 zero-days in edge devices, including routers, switches and security appliances, while cautioning that detection limitations likely mean the number understates the true scale. These systems matter because they sit at network boundaries or provide security functions, yet can be difficult for defenders to monitor.
End-user products made up the other half
GTIG counted 47 vulnerabilities, or 52%, in end-user platforms and products. Operating systems were the largest product category overall: 39 vulnerabilities, or 44% of the 90. Mobile operating-system zero-days rose to 15 in 2025 from nine in 2024, according to GTIG.
Rank #2
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Browsers accounted for less than 10% of the 2025 total. GTIG says that may reflect browser hardening, but also notes that improved attacker operational security could have made exploitation harder to observe. The lower observed share is not evidence that browser vulnerabilities are no longer a concern.
Recommended Free Tools
What the patterns suggest about risk
GTIG says remote code execution was the most common outcome of the exploited flaws, followed by privilege escalation. Its analysis describes command-injection and deserialization vulnerabilities in enterprise environments; memory-safety issues in user-centered products; access-control bypasses on edge devices; and logic or design flaws in appliances.
Rank #3
- SonicWall NSa4700 Appliance Only - No Service Subscription (02-SSC-4328) - Delivers very high firewall and threat prevention throughput with millions of concurrent connections for large enterprise networks and aggregation sites.
- Defends against ransomware, zero-day exploits, and encrypted malware with Capture ATP sandboxing and RTDMI for precise detection and blocking.
- Enterprise connectivity with multiple 10 GbE SFP+ and 1 GbE ports supports bandwidth-heavy applications and east-west segmentation.
- Scales for thousands of VPN tunnels and large remote workforces, enabling secure connectivity across global sites and data centers.
- Redundant power options and high availability modes provide resiliency for mission-critical operations.
Roughly 35% of the vulnerabilities involved memory-safety issues, particularly use-after-free and out-of-bounds write flaws. That figure is a share of the vulnerabilities in GTIG’s 2025 dataset, not a measure of exploit success or impact. The broader picture is a near-even division between enterprise and end-user products, with important exposure in infrastructure that may be challenging to monitor.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Year-over-year totals can change between reports
The March 2026 review lists 90 zero-days for 2025, 78 for 2024 and 100 for 2023. Those historical counts differ from figures in GTIG’s earlier report: its 2025 review of 2024 listed 75 for 2024 and 98 for 2023. GTIG says its dataset changes as previously unknown incidents are discovered, so the figures should be read as counts from each report’s own vintage rather than as a single fixed series. The earlier figures appear in GTIG’s 2024 Zero-Day Exploitation Analysis.
Quick Recap
Best Value
- Built on a purposed-built secure processor, this compact network firewall delivers the highest level of security performance and energy efficiency in its class – 2.5 Gbps IPS throughput | 1.3 Gbps threat protection | 1.4 Gbps SSL Inspection throughput.
- User-friendly management console gives you centralized visibility and simplifies policy enforcement across your network. Its zero-touch deployment helps you optimize your onboarding experience.
- Compact design equipped with 10 x GE RJ45 ports (including 7 x Internal Ports, 2 x WAN Ports, 1 x DMZ Port) provide essential connectivity and flexibility for various network configurations in branch offices.
Rank #4
- 150W High Output Power Supply – Delivers stable 12V DC 12.5A output for Sophos XGS desktop firewall appliances requiring a 150W external power adapter. Designed for continuous network security operation in business and enterprise environments.
- Compatible Sophos XGS Models – Compatible with Sophos XGS 116, XGS 116w, XGS 118, XGS 118w, XGS 126, XGS 126w, XGS 128, XGS 128w, XGS 136, XGS 136w and XGS 138 firewall security appliances.
- Reliable Enterprise Performance – Built for firewall, network gateway and security appliance applications where stable power delivery is critical for uninterrupted network operation and security services.
- Universal AC Input – Supports worldwide input voltage 100-240V AC, 50/60Hz for business, IT deployment and enterprise network installations across multiple regions.
- Professional Replacement Power Solution – Ideal replacement for aging, damaged or missing power adapters used with Sophos XGS Series security appliances. Provides dependable power for long-term deployment in office, MSP, education and enterprise environments.
Attribution covers only cases GTIG could assign
GTIG attributed at least 10 zero-days to assessed China-nexus espionage groups and nine to likely or confirmed financially motivated threat groups. It also said commercial surveillance vendors accounted for more exploitation than traditional state-sponsored cyber-espionage groups for the first time in its tracking. These are GTIG’s assessments of activity it could attribute; they do not classify all 90 vulnerabilities or establish universal totals.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
