A zero-day vulnerability is a flaw in software, firmware or hardware that attackers exploit before the people who made it know it exists, or before they have had time to release a fix. The name comes from the fact that the vendor has had zero days to prepare: by the time the flaw comes to light, attacks may already be under way, and there is no patch to install yet.

The US National Institute of Standards and Technology (NIST) defines a zero-day attack as an attack that exploits a previously unknown hardware, firmware or software vulnerability. That definition is the key to the whole idea: the danger is not that the flaw is especially clever, but that it is unknown, so no defence has been built for it.

Why is it called a zero-day?

Security teams count the time a software maker has had to fix a flaw. If researchers find a bug, tell the vendor, and the vendor ships a patch before anyone misuses it, the flaw was never a zero-day. If attackers find it first and start using it while the vendor is still unaware, the vendor has had zero days with a fix in hand. Once a patch is released and installed, the flaw stops being a zero-day and becomes an ordinary known vulnerability.

Zero-days are often confused with other terms. A vulnerability that is publicly disclosed but has no patch yet is sometimes loosely called a zero-day, but under the stricter definitions used by NIST and by Google’s Project Zero, the defining feature is exploitation before the maker knows. A flaw exploited shortly after a fix appears is called a one-day, and one exploited long after a patch has been available is an n-day.

How does a zero-day attack work?

A typical zero-day follows the same pattern, whether the target is a web browser, an email client or a network device:

• Discovery: someone finds a flaw, often a memory error, a logic mistake or a missing security check, in widely used software.
• Exploitation: attackers build code that abuses the flaw, for example to run commands, steal data or take control of a device.
• Silent use: because the flaw is unknown, security software has no signature for the attack, and victims may not realise they have been hit.
• Disclosure and patch: the vendor learns of the flaw, usually from its own researchers, outside security researchers or reports of attacks, and releases a fix.
• Patching: users and organisations install the update, closing the hole.

Zero-days are often used in targeted attacks rather than mass campaigns, because a valuable unknown flaw is worth more if it stays secret. Vendors frequently release emergency fixes within days once a zero-day is confirmed.

A real example: the MOVEit breach

One of the best-known recent zero-days was found in MOVEit Transfer, a file-transfer application used by businesses and public bodies. According to a joint advisory from the FBI and the US Cybersecurity and Infrastructure Security Agency (CISA), the Clop ransomware group began exploiting the previously unknown flaw, tracked as CVE-2023-34362, from 27 May 2023. The flaw was a SQL injection weakness that could let an unauthenticated attacker reach the database behind the application. Because no fix existed when the attacks began, organisations could not simply patch; they had to take systems offline and apply mitigations while the vendor worked on a fix.

How are zero-days tracked?

Once a flaw is known, it usually receives a CVE identifier, a public reference number that lets everyone talk about the same bug. CISA also maintains the Known Exploited Vulnerabilities (KEV) catalog, which it describes as the authoritative source of vulnerabilities that have been exploited in the wild. US federal civilian agencies are required to fix KEV entries by set deadlines under Binding Operational Directive 22-01, and many private organisations use the same list to prioritise their own patching.

How can you protect yourself?

You cannot patch a flaw nobody knows about, but you can reduce the damage if one is used against you:

• Install updates promptly. The moment a vendor releases a fix for a zero-day, the clock starts: attackers know unpatched systems are easy targets.
• Keep software to a minimum. Unused applications and browser extensions are extra doors an attacker could try.
• Use supported software. Products that no longer receive security updates will never get a fix.
• Follow vendor mitigations. When a zero-day is disclosed before a patch exists, vendors often publish workarounds, such as disabling a feature. CISA advises following those instructions and discontinuing use of a product if no mitigation is available.
• Watch official alerts. CISA’s KEV catalog and vendor security advisories are the reliable places to check whether a flaw is being actively exploited.

Frequently asked questions

Is every newly found vulnerability a zero-day? No. A vulnerability only counts as a zero-day if it is exploited before the maker knows about it or before a fix exists. Most bugs are found by researchers, reported responsibly and fixed before attackers can use them.

What happens once a patch is released? The flaw stops being a zero-day. It becomes a known vulnerability with a fix, and the risk shifts to anyone who has not yet installed the update.

Can antivirus software stop a zero-day? Not reliably. Traditional antivirus relies on recognising known threats, and a zero-day is unknown by definition. Keeping software updated, limiting what is installed and following vendor mitigations are more effective defences.

Where can I check if a flaw is being exploited? CISA’s Known Exploited Vulnerabilities catalog lists vulnerabilities with evidence of active exploitation, with deadlines for US federal agencies to fix them.

Sources: NIST Computer Security Resource Center glossary and CISA Known Exploited Vulnerabilities catalog.