Zero-day vulnerability

The word "zero-day" is applied to three related but distinct things, and precision matters. A zero-day vulnerability is a flaw unknown to the vendor, or known but unpatched, at the moment it is first used against real targets. A zero-day exploit is the working technique or code that leverages it. A zero-day attack is the actual use of that exploit before a fix exists. The name reflects that the vendor has had zero days to remediate. Once a patch is released, the flaw stops being a zero-day; if attackers keep exploiting unpatched systems afterward it becomes an "N-day" or "one-day" vulnerability, which in practice causes far more compromises than true zero-days because many organisations patch slowly.

The defining property is the window of exposure - the interval between first exploitation and the availability and deployment of a fix - during which signature-based and patch-based defences are structurally unable to help, since neither a signature nor a patch yet exists. This is why zero-days command high value: legitimate bug-bounty programs and grey-market exploit brokers both pay large sums, and commercial spyware vendors (the Pegasus/NSO Group case being the most documented) have weaponised zero-click zero-days against mobile devices. State-grade operations have chained multiple zero-days for effect, as the Stuxnet campaign against Iranian centrifuges famously did around 2010.

Because prevention by patching is impossible during the window, defence relies on measures that do not depend on knowing the specific flaw: defence-in-depth and least privilege to limit what a successful exploit reaches; behavioural and anomaly detection (EDR/XDR) that flags the effects of exploitation - unexpected process behaviour, memory corruption, unusual outbound traffic - rather than a known pattern; exploit-mitigation technologies (ASLR, DEP, control-flow integrity, sandboxing) that raise the cost of turning a bug into reliable code execution; and virtual patching at a WAF or IPS to block exploit traffic before the vendor fix lands. Rapid patch deployment once a fix appears is what shrinks the far larger N-day exposure.

Coordinated Vulnerability Disclosure shapes how zero-days become known: researchers typically report privately and allow a remediation window (Google's Project Zero uses a 90-day policy) before public disclosure, whereas full disclosure or a leak can turn a quietly held flaw into mass exploitation overnight. CISA's Known Exploited Vulnerabilities catalogue records flaws confirmed to be exploited, several of which began as zero-days. A common misconception is that zero-days are the main threat to most organisations; for the majority, known-but-unpatched vulnerabilities, misconfiguration and phishing account for far more incidents, so basic hygiene usually reduces risk more than defending against exotic zero-days. A zero-day is a special case of a vulnerability defined by timing - the absence of an available patch when exploitation begins - not by any different underlying nature.