What is a zero-day vulnerability?

Question

Accepted Answer

A zero-day is a vulnerability that is being exploited, or is publicly known, before the vendor has a patch available — leaving defenders zero days to have fixed it. The term is used loosely for three related things: an unknown flaw, an unpatched flaw, and an attack using one. The distinction matters because only the third means someone is being attacked.

Once a patch ships, the vulnerability stops being a zero-day, but the risk often does not drop for weeks. Attackers reverse-engineer patches quickly, and unpatched systems become easier targets after disclosure, not harder.

Zero-days attract disproportionate attention relative to their share of real incidents. The overwhelming majority of successful intrusions still use known, patchable vulnerabilities, stolen credentials, or social engineering.

Practical defence against zero-days is rarely about the specific flaw: segmentation, least privilege, monitoring and a tested response process reduce the impact of an exploit you could not have patched in advance.