zero-day
termsecurityhacking
A vulnerability unknown to the vendor, with zero days available to have patched it.
A zero-day is dangerous precisely because no fix exists yet: defenders have had zero days of warning. The term stretches to the exploit that uses such a flaw. Once the vendor learns of it and ships a patch, the clock starts and it is no longer a zero-day.
A zero-day is a vulnerability the vendor has had zero days to fix, and the term is used loosely enough to be worth pinning down. Strictly it means no patch exists; colloquially people apply it to anything being exploited before organizations have deployed the fix, which is a different and much more common situation.
Its value to an attacker comes precisely from the absence of a signature to detect or a patch to apply, which is why they are hoarded, sold, and used sparingly against high-value targets rather than sprayed widely. Using one publicly burns it, since disclosure follows detection and a fix follows disclosure, so the economics push toward restraint until the target justifies the loss.
The defensive conclusion is unwelcome but freeing. You cannot patch what has no patch, so resilience has to come from elsewhere: reduced attack surface, segmentation so one compromise is not total, detection that keys on behaviour rather than known signatures, and an incident process that works. Meanwhile the honest statistic is that the overwhelming majority of breaches use vulnerabilities that were patched months earlier, so an organization worried about zero-days while running unpatched software has its risks ordered wrongly.
Also known as: 0-day, 0day, zero day, zero-day exploit