A zero-day vulnerability is a weakness in hardware, firmware or software that was previously unknown. NIST defines a zero-day attack as an attack that exploits such a previously unknown weakness. Because nobody knows about the flaw beforehand, there is no vendor fix to install until the maker learns of it.
- Also Called3other nameszero-day · 0-day · zero-day exploit
- Read Next1guide on the same topicThreat Intelligence 101
What is a zero-day vulnerability?
A zero-day vulnerability is a weakness in hardware, firmware or software that the people responsible for it do not yet know about. The name “zero-day” is commonly explained as meaning defenders have had no days to prepare. That explanation is general background, not a rule from a single standard.
NIST defines a zero-day attack as an attack that exploits a previously unknown hardware, firmware, or software vulnerability. In this sense, “exploit” means to use a weakness to do something the owner did not intend.
How does a zero-day attack work?
The key point is that the weakness is unknown beforehand. If nobody knows about a flaw, nobody can have built a fix for it. An attacker who finds it first can often use it before a defense exists. This is general reasoning, so treat it as a simple picture and not as a description of any one case.
A simple illustration
This is a generic example. Imagine a program has a flaw in how it handles a certain kind of input. Its maker has not noticed it. Someone else finds it and writes code that abuses it. Until the maker learns of the flaw, there is no vendor fix to install.
How can you reduce the risk?
Because the flaw is unknown, you cannot patch it in advance. CISA does describe steps for vulnerabilities that are known to be exploited. These steps apply once a weakness becomes known and tracked.
- CISA says organizations should apply mitigations in line with vendor instructions.
- CISA says stakeholders are responsible for evaluating each asset’s internet exposure.
- CISA says to discontinue use of the product if mitigations are unavailable.
CISA also maintains the Known Exploited Vulnerabilities Catalog. CISA describes it as the authoritative source of vulnerabilities that have been exploited in the wild. It asks organizations to use the catalog as an input to their vulnerability management prioritization framework. That means a team can use the list to help decide which fixes come first.
How does it relate to nearby terms?
A zero-day is one kind of vulnerability. Related terms include vulnerability management, patch management and remote code execution. A zero-day attack can be described by the attacker’s tactics, techniques and procedures, but the zero-day label itself only says the weakness was unknown beforehand.
Is a zero-day vulnerability the same as a zero-day exploit?
The two phrases are often used for nearly the same idea. Strictly, the vulnerability is the weakness, and the exploit or attack is the use of that weakness. NIST’s glossary entry is for the attack.
Is every known exploited vulnerability a zero-day?
No. CISA’s catalog covers vulnerabilities exploited in the wild. A vulnerability can be exploited after it is publicly known, and then it is no longer unknown, so it does not fit the NIST wording of a previously unknown weakness.
| Question | Zero-day vulnerability | Known exploited vulnerability |
|---|---|---|
| What it is | A weakness previously unknown, per the NIST wording | A weakness exploited in the wild, which may be publicly known |
| Vendor fix | None to install until the maker learns of it | Apply mitigations in line with vendor instructions |
| How to use it | Cannot be patched in advance | Use the CISA catalog as an input to prioritization |
Can a zero-day be in hardware?
Yes. NIST’s definition names hardware, firmware and software.
Two cases on our incident pages involve a zero-day: the Predator spyware attempts against an Egyptian opposition candidate used an iPhone zero-day chain, and Singapore’s Cyber Security Agency says the UNC3886 campaign against telecoms operators used a zero-day exploit.
See also
Also Called.
- Namezero-day
- Name0-day
- Namezero-day exploit
Questions.
-
What is a zero-day vulnerability?
It is a weakness in hardware, firmware or software that the people responsible for it do not yet know about. NIST defines a zero-day attack as one that exploits such a previously unknown weakness.
-
Can you patch a zero-day in advance?
No. Because the flaw is unknown, nobody can have built a fix for it yet, so you cannot patch it in advance. Once it becomes known and tracked, vendor mitigations and fixes can apply, and CISA's steps for exploited vulnerabilities become relevant.
-
What does CISA advise for exploited vulnerabilities?
CISA says to apply mitigations in line with vendor instructions, evaluate each asset's internet exposure, and discontinue use of the product if mitigations are unavailable.
-
Is every known exploited vulnerability a zero-day?
No. CISA's Known Exploited Vulnerabilities Catalog covers vulnerabilities exploited in the wild, and a vulnerability that is already known and listed there was no longer unknown beforehand, so the zero-day label does not simply apply.
Sources
In Our Research
- 1 CVE-2026-104286: FortiMail Unauthenticated Arbitrary File Write Zero-Day Under Active Exploitation October 2026
- 2 Two NetScaler Zero-Days, One Wrong Assumption: Why Patching Does Not Close the Incident October 2026
- 3 CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Zero-Day Under Active Exploitation September 2026
- 4 Operation ForumTroll: What Is Confirmed About the Chrome Zero-Day (CVE-2025-2783) January 2026
- 5 Actively Exploited Two New Zero-Day Vulnerabilities Hit Google Chrome August 2024
- 6 CVE-2024-38193: Microsoft Patches High-Severity Zero-Day Exploit Used by North Korea’s Lazarus Group August 2024