Rising exploitation pressure from zero-days and known exploited vulnerabilities

Security reporting and research highlighted accelerating exploitation pressure on enterprises, driven by both zero-day activity and the growing backlog of known exploited vulnerabilities (KEVs). A Talos retrospective counted 48,196 CVEs in 2025 and 241 KEVs (up from 186 in 2024), with a notable share of KEVs originating from older CVEs and even vulnerabilities dating back to 2007—reinforcing that attackers continue to monetize long-lived weaknesses when patching and asset visibility lag. Talos also noted disproportionate exploitation targeting network edge infrastructure (e.g., firewalls/VPNs), underscoring the operational risk of unpatched or hard-to-patch appliances and legacy systems.

Separate threat reporting pointed to expanding attack volume and shifting attacker tradecraft that can amplify exploitation impact. Check Point data cited by Dark Reading said Latin America is seeing substantially higher weekly attack volume than the US (including higher proportions of ransomware and infostealer activity), consistent with adversaries concentrating on regions with faster digital adoption and lower security maturity. CSO Online also reported that the Coruna iOS exploit kit rapidly evolved from a targeted spyware capability into broader criminal use, illustrating how advanced exploitation tooling can commoditize quickly and increase the likelihood of opportunistic compromise across a wider victim set.