Comment by Human-Cabbage

China and/or Russia might have a collection of zero-days they've been sitting on, which they could surreptitiously provide to Iran. Of course, there's attribution risk there, and the opportunity cost of not saving those zero-days for their own later use.