State of Exploitation

1H‑2025 saw a rapid escalation in vulnerability exploitation, with 432 new KEVs and an increase in zero‑day‑like activity driven by fast-moving threats across CMS platforms, network devices, and server software. Nation‑state exploitation trends shifted, with Russia and Iran rising while activity tied to China and North Korea declined. These findings reinforce the tightening response window defenders face and the critical need for broad, timely vulnerability intelligence.