A vendor-based analysis of zero-day vulnerabilities from 2006 to 2023, revealing which companies are most associated with exploitable weaknesses, and what organisations can learn from the patterns.
Marco Cavani
Cybersecurity Analyst
The National Institute of Standards and Technology (NIST) defines zero-day attacks as the exploitation of previously unknown vulnerabilities in software or hardware. These attacks take advantage of unknown weaknesses before developers can fix them, leaving victims vulnerable to exploitation.
It is important to notice that the majority of total zero-day vulnerabilities between 2006 and 2023 can be associated with well-established vendors, as their products are widely used.
The distribution of zero-day vulnerabilities across vendors reveals which companies are most associated with high-risk exposure:
On 2023-05-09, Microsoft identified and patched a zero-day vulnerability related to the Elevation of Privilege. Prior to the patch, the vulnerability was actively exploited in real-world attacks (Marchuk, 2023).
The vulnerability enabled attackers to escalate privileges by exploiting a boundary error within the Win32k driver. A local user could trigger memory corruption, ultimately allowing arbitrary code execution with SYSTEM privilege.
As reported by Google Project Zero (2022), many zero-day vulnerabilities had close associations with previously disclosed weaknesses. This suggests that more thorough investigation and patching efforts could have potentially prevented a significant portion of these exploits.
Addressing the root cause of vulnerabilities, not just the symptoms, is critical to reducing zero-day exposure.
Written by
Marco Cavani
Cybersecurity analyst and IT governance professional. Author of digital reports on threat intelligence, critical infrastructure security, and IT audit frameworks.
In May 2017, WannaCry ransomware spread across 150 countries in hours. The NHS lost 19,000 appointments. The vulnerability it exploited had been patched two months earlier. Endpoint protection is the control that closes that gap.
In December 2021, a critical vulnerability in the Log4j logging library put hundreds of millions of devices at risk. The flaw had existed for years. Exploitation appeared within hours of disclosure. Vulnerability Management is the only control that closes that window.
A strategic deep-dive into NIST's Computer Security Incident Handling Guide, covering the full IR lifecycle, team structure, detection methods, prioritisation frameworks, and the power of post-incident learning.
Get the latest cybersecurity reports, threat intelligence, and IT governance insights delivered straight to your inbox. No spam. Unsubscribe any time.
No spam. Unsubscribe at any time.
The RACM ITGC SaaS platform helps audit professionals manage IT General Controls assessments, from risk and control mapping to workpaper generation and evidence tracking.
