The Sub-Zero Reality: Inside the Industrialization of Zero-Day Exploitation (2022–2026)

The traditional vulnerability-management model rests on a single assumption: that a usable window opens between the release of a patch and the weaponization of the flaw it fixes. That assumption has now officially expired. Over the past five years, zero-day vulnerabilities have evolved from rare, hoarded nation-state capabilities into a persistent, industrialized fixture of the enterprise threat landscape.

Data drawn from the Google Threat Intelligence Group (GTIG), Mandiant, VulnCheck, and CISA between 2022 and October 2026 reveals two defining shifts: the inversion of the time-to-exploit window, and a structural pivot toward unmonitored enterprise edge infrastructure.

1. The New Baseline: Volume and Sub-Zero Velocity

Prior to 2020, tracked in-the-wild zero-day exploitation hovered between 30 and 40 flaws annually. Since 2021, annual volume has established a sustained plateau of 60 to 100 zero-days per year. In its March 2026 report, Look What You Made Us Patch: 2025 Zero-Days in Review, GTIG documented 90 zero-days exploited in the wild in 2025 — a 15% increase over 2024's revised count of 78, and second only to the record 100 tracked in 2023. Through the first eight months of 2026, GTIG observed the pace accelerating to an average of 11 zero-days per month, up from 8 per month in 2025.

While sustained volume is concerning, it is the collapse in exploitation velocity that breaks traditional defensive workflows. Between 2018 and 2019, Mandiant recorded an average time-to-exploit (TTE) of 63 days — two months for defenders to test and deploy patches. According to Mandiant's M-Trends 2026, the estimated mean TTE crossed zero in 2024 (minus 1 day) and fell further in 2025 to minus 7 days.

Independent telemetry corroborates this inversion:

• Same-day KEV exploitation. VulnCheck's State of Exploitation research found that 28.96% of Known Exploited Vulnerabilities cataloged in 2025 showed evidence of exploitation on or before the day their CVE was publicly disclosed — up from 23.6% in 2024. Across VulnCheck's own broader catalogue of 884 KEV additions in 2025, 32.1% showed exploitation evidence on or before CVE assignment.
• Pre-CVE weaponization. CyberMindr's 2025 exploit-timeline research noted that roughly 80% of exploit code circulates publicly before an official CVE identifier is even assigned, by an average of 23 days.
• The remediation gap. While exploitation happens in negative time, Verizon's 2026 Data Breach Investigations Report (DBIR) found that the median time for organizations to fully remediate CISA KEV vulnerabilities slowed from 32 days in 2024 to 43 days in 2025, with 16% of KEVs remaining completely unremediated.

The result is a widening scissors-gap: attack timelines compress below zero while remediation timelines stretch past six weeks.

2. The Tactical Pivot: Why Attackers Moved to the Enterprise Edge

As endpoint detection and response (EDR) agents and browser sandboxes matured on client workstations, the return on investment for end-user exploits plummeted. Threat actors responded by shifting zero-day discovery toward infrastructure where defensive visibility is lowest.

The Siege on Enterprise Appliances

In 2025, both the raw count (43) and the proportion (48%) of zero-days impacting enterprise technology reached all-time highs — up from 33, or 44%, in 2024. Within that category, security and networking appliances — VPN concentrators, firewalls, load balancers, and unified threat-management gateways from vendors such as Cisco, Ivanti, Fortinet, and Palo Alto Networks — remained the premier target, accounting for over 60% of enterprise zero-day exploitation in 2024 and generating 14 distinct edge zero-days in 2025. By total volume across all product types in 2025, Microsoft led with 25 zero-days, followed by Google with 11, Apple with 8, and Cisco with 4.

State-sponsored espionage groups — particularly PRC-nexus actors, to whom GTIG attributed at least 10 zero-days in 2025 (double their 2024 count) — focused just over half of their attributed zero-day operations on edge devices and security appliances. Compromising an edge appliance grants an adversary three distinct operational advantages:

• No EDR telemetry. Proprietary, stripped-down network operating systems cannot run standard third-party EDR agents, allowing memory-resident implants and webshells to operate without triggering behavioural alerts.
• Pre-authentication reachability. Exposed directly to the WAN, authentication-bypass and command-injection flaws on edge appliances circumvent MFA and identity and access management (IAM) controls entirely.
• End-of-life persistence. VulnCheck found that 42.5% of the 181 network-edge vulnerabilities added to its catalogue in 2025 affected end-of-life or near-EoL hardware — turning unpatchable flaws into permanent zero-days.

Browser Hardening Works — Pushing Attackers to the OS and Mobile

Conversely, end-user browser zero-days dropped to a historic low in 2025, accounting for just 8 zero-days (9% of the total). Investment in memory-safe abstractions, Chrome's MiraclePtr, and V8 sandboxing has made standalone browser compromise prohibitively expensive. Notably, GTIG reported that none of the browser sandbox escapes analyzed in 2025 exploited flaws in the browser sandbox itself; every one had to target the underlying operating system kernel or hardware drivers to break out.

As a result, operating systems (desktop and mobile combined) absorbed the displaced attacker effort, rising to 39 zero-days (44% of the total) in 2025 — up from 31 (40%) in 2024 and 33 (33%) in 2023:

• Desktop OS: 24 zero-days (27% of the 2025 total).
• Mobile OS: rebounded sharply from 9 zero-days in 2024 to 15 zero-days (17%) in 2025. Because modern mobile operating systems enforce strict component isolation, roughly 90% of multi-zero-day exploit chains are now deployed exclusively against mobile devices, frequently targeting third-party GPU, baseband, and multimedia components.

3. Attribution and the “Source-Code-to-Zero-Day” Supply Chain

Of the 90 zero-days tracked in 2025, GTIG attributed 42 to specific actor categories, revealing a three-tier ecosystem:

• State-sponsored espionage and intellectual-property theft. Traditional state-sponsored and likely state-sponsored espionage accounted for roughly 35% of attributed zero-days. Crucially, GTIG highlighted a dangerous paradigm shift exemplified by the BRICKSTORM campaigns of 2025: rather than merely stealing diplomatic or customer data, PRC-nexus operators targeted technology and software vendors to exfiltrate proprietary source code and internal development documentation — using stolen IP to discover new zero-days in those vendors' products and compromise downstream customers.
• Commercial surveillance vendors (CSVs). Private-sector spyware vendors remained the primary drivers of mobile and browser exploit chains, continuously adapting their multi-bug chains to bypass newly introduced mobile security boundaries and selling turnkey access to government clients worldwide.
• Financially motivated cybercrime and ransomware. Financially motivated groups accounted for 9 attributed zero-days (20.9% of attributions) in 2025, while VulnCheck found that 56.4% of 2025 ransomware CVEs were first identified through active zero-day exploitation. GreyNoise research in February 2026 revealed that 59 existing KEV vulnerabilities silently flipped to “known ransomware use” during 2025, and Mandiant's M-Trends 2026 noted that once an initial-access broker compromises an environment, the handoff to a ransomware affiliate has collapsed to as little as 22 seconds.

4. The 2026 Acceleration: AI Compression and Unpatched Disclosures

Throughout 2026, two compounding pressures have intensified the zero-day problem:

• Unpatched vendor advisories. According to Trend Micro's Zero Day Initiative (ZDI), 255 out of 1,202 advisories (21%) published in 2025 — and 78 of 751 advisories through October 1, 2026 — were released as zero-days without a vendor patch available, because vendors failed to remediate within the coordinated-disclosure deadline.
• AI-accelerated exploitation. Both GTIG and Mandiant note that adversaries are actively using large language models to compress reconnaissance, vulnerability comprehension, and payload adaptation. When advisories drop, N-day weaponization is virtually instantaneous — prompting CISA in May 2026 to evaluate slashing its standard KEV remediation mandate from 14–21 days to just 3 days.

5. Defensive Architecture for a Negative-TTE World

When estimated mean time-to-exploit sits at minus 7 days and median enterprise patching takes 43 days, a strategy built predominantly around “patch-on-advisory” will fail against initial access. Defenders must architect their environments under the assumption that perimeter appliances are already compromised:

1. Architect zero-trust around perimeter appliances. Isolate VPN concentrators, firewalls, and MFT appliances in strict DMZs. Restrict outbound internet egress from all edge appliances (breaking reverse shells and C2 callbacks) and enforce strict microsegmentation so an appliance cannot initiate unbrokered connections to internal Active Directory or database tiers.
2. Eliminate WAN-exposed management planes. Never expose administrative portals or SSH/HTTPS management interfaces to the public internet. Gate all appliance administration behind out-of-band management networks or separate identity-aware proxies.
3. Mandate off-box telemetry and egress monitoring. Because edge appliances lack EDR, ingest real-time NetFlow data, enforce immutable off-box syslog streaming (defeating post-exploitation log tampering), and alert on anomalous child processes or unexpected internal scanning originating from perimeter IP space.
4. Purge end-of-life hardware. With 42.5% of exploited edge vulnerabilities hitting EoL devices, maintaining legacy perimeter hardware is indefensible. Track hardware lifecycle dates inside your vulnerability-management platform with the same severity as critical CVEs.
5. Automate ephemeral rebuilds for virtual appliances. Move virtualised edge gateways toward immutable-infrastructure pipelines that regularly destroy and redeploy appliances from known-good golden images — eradicating memory-only implants that depend on multi-month uptimes.

The through-line is simple: assume the perimeter is already gone, and build the controls that catch an intruder who has been living on your edge appliance for months.

References

• Google Threat Intelligence Group (GTIG): Look What You Made Us Patch: 2025 Zero-Days in Review (March 5, 2026).
• Mandiant (Google Cloud): M-Trends 2026 Report (March 2026).
• VulnCheck: State of Exploitation H1 2025 and 2026 Exploit Intelligence reports.
• Verizon: 2026 Data Breach Investigations Report (DBIR) — KEV remediation telemetry.
• CISA: Known Exploited Vulnerabilities (KEV) catalogue telemetry (through October 1, 2026).
• GreyNoise Research: The Noise in the Silence: Unmasking CISA's Hidden KEV Ransomware Updates (February 2, 2026).
• Trend Micro Zero Day Initiative (ZDI): 2025–2026 advisory and unpatched-disclosure statistics.

Figure aggregation and analysis by SIA Force Threat Intelligence. Statistics are reproduced as published by the cited vendors; forward-looking 2026 figures are year-to-date as of October 1, 2026.