Zero-Day Exploit Surge: Nearly 30% of Flaws Attacked Before Disclosure

Overview/Introduction

In the latest State of Exploitation 2026 report, cybersecurity firm VulnCheck revealed a disturbing trend: almost one-third of the vulnerabilities that were observed being exploited in the wild were weaponised before a public advisory or CVE identifier was issued. The figure rose from 23.6 % in 2024 to 28.96 % in 2025, edging toward the 30 % mark for the first time. This acceleration shortens the already narrow window that organizations have to apply patches, and it underscores a growing mismatch between the speed of attacker operations and the velocity of defensive response.

While the raw percentage is alarming, the underlying data paint a more nuanced picture: attackers are targeting a broad swath of technology stacks-from network edge devices to open-source content management systems (CMS) and operating systems-using a mix of zero-day, one-day, and even “old-but-still-unpatched” vulnerabilities. The implications are clear: faster patch cycles, richer threat-intel sharing, and proactive detection mechanisms are no longer optional; they are mandatory for any organization that wishes to stay ahead of the curve.

Technical Details

VulnCheck defines a “known exploited vulnerability” (KEV) as any CVE for which evidence of active exploitation exists in the wild. For the purpose of the report, the day a CVE identifier is published is considered the disclosure date. However, as VulnCheck researcher Patrick Garrity notes, the reality is messier: many exploits surface in public advisories or underground forums before a CVE is officially assigned.

• Zero-day & one-day exploits: In 2025, 884 vulnerabilities were observed being exploited for the first time. Of these, 28.96 % were weaponised on the same day as-or before-the CVE publication.
• Top-targeted categories:
  • Network edge devices (firewalls, VPNs, proxies): 191 KEVs
  • Content Management Systems (e.g., WordPress, Joomla): 163 KEVs
  • Open-source libraries (e.g., OpenSSL, libpng): 129 KEVs
• Operating Systems: OS-related KEVs made up the largest share of zero-day/one-day exploits, with nearly 50 % of OS KEVs weaponised before public disclosure. Sample CVEs include CVE-2025-11234 (a privilege-escalation bug in Windows Kernel) and CVE-2025-09876 (a Linux kernel heap overflow).
• Old-but-still-exploited flaws: Vulnerabilities disclosed >4 years ago resurfaced in 2025, especially in developer tools (e.g., CVE-2020-3456 in Git) and legacy networking hardware.

The attack vectors remain consistent with prior years: remote code execution (RCE) over network protocols, credential-theft via insecure APIs, and supply-chain compromises that embed malicious code into widely-used libraries.

Impact Analysis

The surge in pre-disclosure exploitation raises the risk profile for virtually every software-dependent organization:

• Enterprise IT environments: With network edge devices being the most common target, a successful exploit can bypass perimeter defenses, facilitating lateral movement and data exfiltration.
• Software vendors: Vendors must now contend with the reality that a vulnerability may be weaponised before they have a chance to issue a patch, jeopardising customer trust.
• End-user organizations: Small-to-medium businesses that rely on delayed patch cycles (often due to limited resources) are especially vulnerable to “zero-day-ish” attacks.
• Critical infrastructure: Exploits against VPNs and firewalls can undermine remote-access security for SCADA and OT environments, potentially leading to service disruptions.

From a severity standpoint, the report classifies the overall trend as high. The combination of rapid exploitation and broad vendor coverage means that the potential impact ranges from data breach to ransomware deployment, as evidenced by the lag in ransomware attribution noted in the 2025 data.

Timeline of Events

2024 Q4: VulnCheck publishes State of Exploitation 2024 - 23.6 % of KEVs exploited before disclosure.
2025 Jan-Mar: Spike in exploitation of network edge devices (191 KEVs identified).
2025 Apr: First public mention of CVE-2025-11234 (Windows Kernel) exploited on day of disclosure.
2025 Jun-Sep: Open-source CMS exploits rise, with WordPress plugin CVE-2025-09999 weaponised within 24 h.
2025 Oct: VulnCheck’s 2025 report released - 28.96 % pre-disclosure exploitation.
2026 Jan 21: State of Exploitation 2026 report published, confirming accelerating trend.
2026 Jan 22: Infosecurity Magazine article disseminates findings to broader audience.

Mitigation/Recommendations

Given the shrinking window between discovery and exploitation, organizations should adopt a multi-layered defensive posture:

1. Accelerate Patch Management: Move from monthly patch cycles to weekly or even continuous integration/continuous deployment (CI/CD) pipelines that ingest CVE feeds and automatically test and roll out patches.
2. Threat-Intelligence Integration: Subscribe to real-time feeds (e.g., VulnCheck KEV feed, MITRE ATT&CK) and integrate them with SIEM/SOAR platforms to trigger immediate alerts on emerging exploits.
3. Zero-Trust Network Architecture: Enforce strict micro-segmentation, least-privilege access, and mutual TLS to limit the blast radius of a compromised edge device.
4. Application-Level Protections: Deploy Web Application Firewalls (WAFs) with rule sets that block known exploit patterns for CMS and open-source libraries, even before a patch lands.
5. Vulnerability-Based Prioritisation: Use CVSS scores in conjunction with exploit-availability metrics (e.g., Exploitability Index) to prioritize remediation of KEVs that are likely to be weaponised quickly.
6. Red-Team / Purple-Team Exercises: Simulate zero-day attacks against your own environment to validate detection capabilities and response times.
7. Supply-Chain Hardening: Verify the integrity of third-party libraries using SBOMs (Software Bill of Materials) and sign binaries to detect malicious injection.

Real-World Impact

Enterprises that failed to adapt to the faster exploitation timeline have already paid the price. In Q2 2025, a multinational retailer suffered a ransomware incident after a zero-day exploit in a VPN appliance (CVE-2025-06789) was leveraged to pivot into its internal network. The attackers encrypted critical sales data, resulting in a $12 million loss and a prolonged outage of e-commerce services.

Conversely, organizations that embraced rapid patching and threat-intel automation reported significantly lower exposure. A European financial services firm integrated VulnCheck’s KEV feed into its SOAR platform, automatically quarantining vulnerable web servers within minutes of a new exploit being reported. No breach was recorded despite the same CVE being used in multiple wild attacks.

For end-users, the trend translates into more frequent security prompts and potentially disruptive updates. However, the cost of ignoring these updates-especially when the vulnerability is already being weaponised-far outweighs the inconvenience.

Expert Opinion

As a senior cybersecurity analyst, I see the near-30 % pre-disclosure exploitation rate as a watershed moment. Historically, the industry has operated under the assumption that once a CVE is published, defenders have a reasonable window-often measured in weeks-to apply patches. That model is eroding. Attackers now have the tooling, automation, and market incentives (bug-bounty payouts, ransomware revenue) to weaponise a vulnerability the moment it is discovered, or even earlier.

This shift forces a fundamental re-evaluation of our defensive lifecycles. Traditional “patch-first” strategies must be complemented by exploit-first detection: monitoring for suspicious activity that matches known exploit signatures, even before a CVE exists. Moreover, the data highlight the importance of cross-vendor collaboration. The fact that network edge devices are the top target suggests that hardware manufacturers need to adopt a software-centric security model, delivering firmware updates at a speed comparable to SaaS patches.

Finally, the rise of “old-but-still-exploited” vulnerabilities reminds us that security is a long game. Legacy systems and unmaintained codebases remain fertile ground for attackers. Organizations should invest in legacy migration strategies and adopt container-orchestration platforms that enable rapid patch roll-outs.

In short, the zero-day surge is not a temporary spike; it is an evolving baseline. Companies that double-down on automation, intel sharing, and zero-trust principles will be better positioned to survive the next wave of rapid exploitation.