Zero-Day Vulnerability.

What Is a Zero-Day Vulnerability?

A zero-day vulnerability is a weakness in hardware, firmware or software that the people responsible for it do not yet know about. The name “zero-day” is commonly explained as meaning defenders have had no days to prepare. That explanation is general background, not a rule from a single standard.

NIST defines a zero-day attack as an attack that exploits a previously unknown hardware, firmware, or software vulnerability. In this sense, “exploit” means to use a weakness to do something the owner did not intend.

How Does a Zero-Day Attack Work?

The key point is that the weakness is unknown beforehand. If nobody knows about a flaw, nobody can have built a fix for it. An attacker who finds it first can often use it before a defense exists. This is general reasoning, so treat it as a simple picture and not as a description of any one case.

A Simple Illustration

This is a generic example. Imagine a program has a flaw in how it handles a certain kind of input. Its maker has not noticed it. Someone else finds it and writes code that abuses it. Until the maker learns of the flaw, there is no vendor fix to install.

How Can You Reduce the Risk?

Because the flaw is unknown, you cannot patch it in advance. CISA does describe steps for vulnerabilities that are known to be exploited. These steps apply once a weakness becomes known and tracked.

• CISA says organizations should apply mitigations in line with vendor instructions.
• CISA says stakeholders are responsible for evaluating each asset’s internet exposure.
• CISA says to discontinue use of the product if mitigations are unavailable.

CISA also maintains the Known Exploited Vulnerabilities Catalog. CISA describes it as the authoritative source of vulnerabilities that have been exploited in the wild. It asks organizations to use the catalog as an input to their vulnerability management prioritization framework. That means a team can use the list to help decide which fixes come first.

How Does It Relate to Nearby Terms?

A zero-day is one kind of vulnerability. Related terms include vulnerability management, patch management and remote code execution. A zero-day attack can be described by the attacker’s tactics, techniques and procedures, but the zero-day label itself only says the weakness was unknown beforehand.

Is a Zero-Day Vulnerability the Same as a Zero-Day Exploit?

The two phrases are often used for nearly the same idea. Strictly, the vulnerability is the weakness, and the exploit or attack is the use of that weakness. NIST’s glossary entry is for the attack.

Zero-Day, N-Day and Known Exploited: How Do They Differ?

Three labels are often mixed up. Each one answers a different question.

• Zero-day: the maker did not know about the flaw when attacks began, so no fix existed.
• N-day: a flaw that is already public and usually has a fix, but that attackers still use against unpatched systems. This is common industry usage, not a term from NIST or CISA.
• Known exploited: a flaw with reliable evidence of use in real attacks, which CISA lists in its catalog. It can be a zero-day or an n-day.

One flaw can wear all three labels over time. It may start as a zero-day, get a fix, and stay in the CISA catalog for years while attackers hit systems that were never patched. A critical flaw with no sign of attacks is none of the three until someone shows evidence.

So not every known exploited vulnerability is a zero-day. CISA’s catalog covers vulnerabilities exploited in the wild. A vulnerability can be exploited after it is publicly known, and then it is no longer unknown, so it does not fit the NIST wording of a previously unknown weakness.

A recent example is the iOS 18.7.11 update for older iPhones. Apple says the CoreGraphics flaw it fixes may have been exploited in an extremely sophisticated attack against specific targeted individuals, and CISA lists it as known exploited.

Question	Zero-day vulnerability	Known exploited vulnerability
What it is	A weakness previously unknown, per the NIST wording	A weakness exploited in the wild, which may be publicly known
Vendor fix	None to install until the maker learns of it	Apply mitigations in line with vendor instructions
How to use it	Cannot be patched in advance	Use the CISA catalog as an input to prioritization

October 2026’s Serious Flaws: Zero-Day or Not?

Five serious flaws drew attention in October 2026. We call a flaw a zero-day only when the vendor or CISA says attacks began before a fix existed. No vendor or CISA source we read calls any of these five a zero-day, so each entry gives its exploitation status instead. Amazon comes closest for PHP2Shell: it reports an exploit attempt against its honeypots on 17 October 2026, four days before disclosure and before a fix existed, but it does not use the word.

• PHP2Shell, CVE-2026-109618 and CVE-2026-109619: PHP published fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October. CISA describes unauthenticated remote code execution and said it had not observed exploitation when it published its alert. Cloudflare said the flaws leaked before the official release and that it saw attack traffic against its customers. Amazon says its MadPot honeypots caught an exploit attempt on 17 October, four days before disclosure.
• GitLab CVE-2026-110264: GitLab fixed an integer overflow in its regular expression compiler in the patch releases of 21 October, starting with 19.5.1. GitLab rates it CVSS 10.0 and says an unauthenticated user could run code on the server. It published detections for exploitation attempts, but its notice reports no attacks, and the flaw was not in the CISA catalog in the 21 October release.
• Ivanti Connect Secure CVE-2026-104935: CISA added this authentication bypass to its catalog on 13 October, citing evidence of active exploitation. Ivanti’s CVE record says a remote attacker with no login can run commands, and lists 25.1.3.0 and 22.8R2.5 among the unaffected versions.
• Siemens Software Center CVE-2026-110936: Siemens published advisory SSA-580366 on 15 October and added the fix, version 4.0.9.8, to it on 17 October. On 19 October it confirmed active exploitation, where attackers place their own files next to a genuine, signed copy of the program. Siemens says the attackers used version 3.5.8.7, “the latest version at the time”, so the attacks may have begun before a fix existed. CISA added the flaw on 20 October.
• PAN-OS CVE-2026-0257: Palo Alto Networks published its advisory on 13 May 2026 and reports limited exploit attempts on unpatched devices. The flaw lets an attacker open an unauthorized VPN connection through GlobalProtect. CISA added it on 29 May. In an update of 19 October, Unit 42 said it still sees attempts by ransomware operators.

Earlier zero-day cases are covered in our FortiMail zero-day write-up and in our analysis of the window before a patch exists. To see which newly exploited flaws touch your own technology, use vulnerability intelligence.

Can a Zero-Day Be in Hardware?

Yes. NIST’s definition names hardware, firmware and software.

Two cases on our incident pages involve a zero-day: the Predator spyware attempts against an Egyptian opposition candidate used an iPhone zero-day chain. Singapore’s Cyber Security Agency says the UNC3886 campaign against telecoms operators used a zero-day exploit.

See Also

• Vulnerability intelligence
• Threat Intelligence Platforms 101
• Vulnerability intelligence use case