Google Reports 75 Zero-Days Exploited in 2024 — 44% Targeted Enterprise Security Products
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2024-21887+1 related CVE | Command Injection RCE in Ivanti Connect Secure and Policy Secure | 9.1 group max | 100% | KEVRansomwarePoC | KEV |
| CVE-2024-21338 | Local Privilege Escalation in Microsoft Windows Kernel via Exposed IOCTL (CVE-2024-21338) | 7.8 | 62% | KEVRansomwarePoC ×3 | KEV |
CVE-2024-29748+1 related CVE | Local Privilege Escalation in Google Pixel (Android), Exploited in the Wild | 7.8 group max | <1% | KEV | KEV |
| CVE-2024-32896 | Local Privilege Escalation in Google Android Pixel Kernel | 7.8 | 3% | KEV | KEV |
| CVE-2024-38178 | Unauthenticated RCE via Memory Corruption in Microsoft Windows Scripting Engine | 7.5 | 41% | KEV | KEV |
CVE-2024-44308+1 related CVE | Arbitrary Code Execution via Crafted Web Content in Apple Safari, iOS, macOS and visionOS | 8.8 group max | 10% | KEV | KEV |
| CVE-2024-49039 | Windows Task Scheduler Elevation-of-Privilege Flaw Actively Exploited in the Wild | 8.8 | 14% | KEVRansomware | KEV |
| CVE-2024-53104 | Out-of-Bounds Write in Linux Kernel UVC Video Driver (CVE-2024-53104) | 7.8 | 3% | KEV | KEV |
| CVE-2024-55956 | Unauthenticated File Upload RCE in Cleo Harmony, VLTrader, and LexiCom | 9.8 | 94% | KEVRansomwarePoC | KEV |
| CVE-2024-9680 | Use-After-Free in Mozilla Firefox Animation Timelines Allows Code Execution | 9.8 | 23% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | microsoftonline.com | ect users' cookies in order to unauthorized access to login.microsoftonline[.]com. The tech giant further noted that it independently disco |
From the original article
3 min read at thehackernews.com
Ravie Lakshmanan Apr 29, 2025 Enterprise Security / Vulnerability Google has revealed that it observed 75 zero-day vulnerabilities exploited in the wild in 2024, down from 98 in 2023 but an increase from 63 the year before. Of the 75 zero-days, 44% of them targeted enterprise products. As many as 20 flaws were identified in security software and appliances.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.