What Is a Zero Day? Vulnerabilities, Exploits, Attacks
Zero day is three different things wearing one name, and the difference decides what you can do about it. Here is what the clock is counting, how many are really out there, and what protects a system that has no patch available.
Every security vendor uses the phrase and almost nobody defines the part that matters, which is the counting. Zero days of what? Zero days since when? That answer is the whole idea, and once you have it a zero day stops being mysterious: it is a flaw with a clock attached, and every defense either shortens that clock or survives it running.
What Is a Zero Day?
The phrase names three different things, and most confusion about the topic comes from people using it for all three in one sentence.
A zero-day vulnerability is the flaw: a mistake in code that lets someone do something the designers never intended, and that the vendor does not yet have a fix for. A zero-day exploit is the working method that abuses that flaw. A zero-day attack is somebody actually using it against a real system.
The formal definitions agree on the shape. NIST's glossary, drawing on CNSSI 4009-2022, calls a zero-day attack one "that exploits a previously unknown hardware, firmware, or software vulnerability." Google's Threat Intelligence Group, which publishes the standing annual count, uses a tighter test in its 2025 zero-day review: a vulnerability that was maliciously exploited in the wild before a patch was made publicly available.
That second definition is the more useful one, because it is measurable. Somebody attacked a real system with it, and there was no fix available when they did. A flaw a researcher finds and reports quietly is not a zero day. A flaw with a patch out is not a zero day, however few people have installed it. The category is a race between an attacker and a vendor, decided by which one got there first.
Three things follow, and they are why the topic behaves oddly compared with every other threat.
- You cannot patch it. For the duration there is nothing to install, and every other piece of security advice assumes an update exists.
- Signature-based tools have never seen it. Antivirus recognizes what it has been taught to recognize, and nobody has taught it this.
- It is temporary. Every zero day becomes an ordinary patchable bug within days or weeks, after which the danger is entirely about how fast you patch.
Why Is It Called a Zero-Day?
The term comes from the days-since-release counting the early warez scene kept: a program cracked on the day it shipped was a "zero-day" release. Security borrowed the arithmetic. The number counts how long the people responsible for fixing something have had to fix it, measured from the moment they found out.
Day zero is the day the vendor learns the flaw exists. If attackers are already using it then, the vendor has had zero days of warning. Once a patch ships the count restarts as a different measure: a flaw with a fix available is an n-day, where n is the days since the patch, and one patched yesterday is a one-day.
Zero-Day Vulnerability vs Exploit vs Attack
Reading a security advisory is much easier once these four words stay separate.
| Term | What it means | Who has it | What you can do |
|---|---|---|---|
| Zero-day vulnerability | A flaw with no fix available | The vendor may not know it exists | Reduce exposure, restrict what is reachable |
| Zero-day exploit | Working code that abuses the flaw | The attacker, and sometimes a broker who sold it | Nothing directly. Detection has to work on behavior |
| Zero-day attack | The exploit used against a real target | Whoever bought or built it | Contain, monitor, limit the damage after entry |
| N-day vulnerability | The same flaw once a patch exists | Everyone, publicly | Patch it, on a clock |
The last row is where most real damage happens. A vulnerability is at its most dangerous to the broadest set of victims after it is public, because publication tells every criminal group in the world exactly where the hole is, and proof-of-concept code usually follows within days. Before publication, one group knew. After it, everyone does, and only the organizations that patched quickly are out of reach.
How a Zero-Day Attack Works
A zero day is not an attack technique, it is a way in. What follows is the same set of moves any intrusion uses: install malware, take credentials, move to the next machine, take the data. The zero day only skipped the part where somebody had to be persuaded to click.
- A mistake in code goes out in a release. It may sit unnoticed for years
- A researcher, a criminal group, a government team or an exploit broker
- The flaw is turned into something reliable enough to use, which is the hard part
- Used quietly against chosen targets. This is where the zero-day clock starts
- From a victim, a researcher, or its own telemetry. Day zero
- The flaw becomes public and stops being a zero day
- Every other attacker reads the advisory and goes after whoever has not patched
- The only step on this list that is yours, and the only one that closes the hole
Two features of that shape drive everything else on this page.
The quiet period is deliberately quiet. An exploit is a wasting asset: use it loudly and it gets noticed, reported and patched, and the investment is gone. Genuine zero-day operations are narrow and careful, aimed at targets worth burning an exploit on.
The loud period comes after the patch. The moment an advisory publishes, the flaw becomes a commodity and scanning for unpatched systems starts within hours. That inversion is why "we do not run anything exotic, so zero days are not our problem" is a reasonable position, and "we patch when we get to it" is not.
How Many Zero-Days Are Exploited Each Year?
This is the question that puts the threat in proportion, and it has an actual answer.
Set that against CISA's Known Exploited Vulnerabilities catalog, which lists 1,695 vulnerabilities with confirmed exploitation in the wild. Ninety new zero days a year across every vendor on earth, against a standing catalog of nearly seventeen hundred flaws that are already public, already patched, and still working because somebody has not applied the update.
Two shifts inside the 2025 numbers matter. Enterprise security and networking products keep climbing as a target, which is a deliberate choice: a firewall or VPN appliance sits at the edge of the network, often runs software endpoint tools cannot inspect, and holds credentials for everything behind it. And commercial surveillance vendors, the companies selling interception tools to governments, accounted for more attributed zero-day exploitation in 2025 than state-sponsored espionage groups did, the first year Google has recorded that.
Examples of Zero-Day Attacks
Log4Shell is the case to know, because the dates are documented and show the shape exactly. The flaw, CVE-2021-44228, sat in Apache Log4j, a Java logging library that CISA's advisory describes as used across consumer and enterprise services, websites, applications and operational technology products. An attacker could take control by sending a specially crafted request that the system then logged. CISA records exploitation beginning on or around December 1, 2021, and public disclosure on December 10. Nine days of true zero-day exposure, then years of cleanup, because the library was buried inside other software and most organizations did not know they were running it.
Stuxnet, the 2010 operation against Iranian uranium enrichment, is the historical reference every explainer reaches for, and its real lesson is about who spends on this. Chaining several unknown Windows flaws into one weapon is not a criminal budget. It is a state one.
Browsers and phones were the zero-day story of the early 2020s and are less so now. Browser exploitation fell below 10 percent of 2025's total, reflecting a decade of sandboxing and automatic updates making that route expensive.
Edge devices are where the money went instead. Google's 2025 review names Cisco, Fortinet, Ivanti and VMware among the vendors most commonly targeted, which is a list of exactly the products that sit at the network boundary. That is the pattern behind recent mass-exploitation events: a flaw in an internet-facing appliance, an advisory, then ransomware crews working through the unpatched population within days. If your organization runs its own firewalls and VPN appliances, those deserve a faster patch clock than anything else you own.
Why Are Zero-Day Vulnerabilities So Valuable?
Because they are scarce, they work against a fully updated target, and they are quiet. Every other route in leaves a trace of a decision somebody made: a password reused, an attachment opened, a prompt approved. A zero day needs none of that, so it defeats the awareness training, the password policy and the patching program at once.
That scarcity supports a real market. Governments buy exploits through brokers and through the surveillance companies Google's data now puts at the top of attributed exploitation, and vendors buy them back through bug bounty programs. Criminal groups mostly do not, because the arithmetic fails: a six-figure exploit competes against phishing, which costs almost nothing and works often enough.
How to Protect Against Zero-Day Attacks
The honest framing: you cannot prevent a zero day, because prevention means installing a fix and there is no fix. What you can do is make yourself a harder target during the window and a fast one afterward. Both are ordinary security work, which is the good news.
The single most useful free resource here is CISA's catalog. Its three inclusion criteria are strict: the flaw has a CVE ID, there is reliable evidence it has been actively exploited in the wild, and there is a clear remediation action available. CISA recommends every organization, not only federal agencies, treat that catalog as a priority list.
The federal deadlines are a useful benchmark to borrow. Binding Operational Directive 26-04 sets risk-based clocks for federal civilian agencies: as little as 3 days for a publicly exposed asset where the exploit is automatable and the impact is total control, 14 or 30 days for other exposed systems, and 60 days for internal ones. No small business has to meet those. Knowing what "urgent" officially means is still the fastest way to settle an argument about whether a patch can wait until the weekend.
Do Zero-Days Actually Affect You?
For most readers, not directly, and the numbers support saying so plainly.
Vulnerability exploitation is now the leading way into an organization: the 2026 Verizon Data Breach Investigations Report puts it at the start of 31 percent of breaches, the first time in the report's 19 years that it has passed stolen credentials. That figure covers vulnerability exploitation as a whole, not zero days, and Verizon's own concern is the speed at which known flaws get used, with AI shrinking the time to exploit from months to hours.
The breach reports published on this site tell the same story from the other end. Not one was a zero-day intrusion. Where the route in is documented, it was social engineering: somebody was phoned, or persuaded to authorize an application. The attacks that empty databases are still overwhelmingly a phishing email or a convincing phone call, which is why the threats that actually breach organizations look mundane next to the ones that make headlines. If any of that data was yours, the sequence in what to do after a data breach applies whatever the way in was, and the recent data breaches index shows the pattern repeating.
Key takeaways
- A zero day is a flaw being exploited before a fix exists. The number counts the days the vendor has had to fix it, which is zero.
- The phrase covers three things: the vulnerability, the exploit code, and the attack. Keeping them apart makes advisories readable.
- Google tracked 90 zero days exploited in 2025, against a CISA catalog of 1,695 vulnerabilities already known to be exploited and already patchable.
- A flaw is most dangerous to most victims after it is public, because publication tells every attacker where the hole is.
- Nothing prevents a zero day. Less exposure, automatic updates, behavioral detection, least privilege and segmentation shorten or contain it.
- CISA's catalog is a free, evidence-based patch priority list, and the federal 3 to 60 day clocks are a fair benchmark to borrow.
Common questions
Why is it called a zero-day?
The number counts the days the vendor has had to fix the flaw, starting from the moment they found out about it. If attackers are already using it when the vendor learns it exists, the vendor has had zero days. The phrase was borrowed from the days-since-release counting used in early software piracy scenes.
What does zero day actually mean in simple terms?
A hole in software that criminals are already using, and that the company who made the software has not fixed yet, usually because they only just learned about it. There is nothing to install while that is true. Once the fix comes out, it is no longer a zero day.
What is a zero-day virus?
A loose term for malware that uses a zero-day vulnerability to install itself, or for malware so new that antivirus has no signature for it. The first is about the way in, the second about detection, and both are why behavioral detection has replaced signature matching.
What is the difference between a zero-day and an n-day vulnerability?
A zero day has no patch available. An n-day does, and n is the number of days since it shipped. Almost all successful exploitation involves n-days, because the advisory tells every attacker where the flaw is and many systems stay unpatched for weeks afterward.
How long does a zero-day vulnerability stay unpatched?
Days to months, depending on how the vendor found out and how hard the fix is. Log4Shell ran about nine days from first observed exploitation to public disclosure. The tail lasts far longer: organizations still running the unpatched version years later, often because it is buried inside other software.
Can antivirus stop a zero-day attack?
Not by recognizing it, because a signature scanner matches things it has seen before and this is new. Endpoint tools can still catch it by watching behavior: a document process spawning a command shell, a service writing to startup, an appliance suddenly making outbound connections.
How would you know if you had been hit by a zero-day?
Usually you would not, at the time. Detection comes from the aftermath rather than the entry: unusual outbound traffic, a new account or scheduled task, logs that gap, a login from somewhere impossible. Most organizations find out from a vendor advisory naming indicators, or from an outside party.
Who finds zero-day vulnerabilities?
Researchers who report them, vendors' own teams, government agencies, exploit brokers who buy and resell, and criminal groups. Google's 2025 data credits commercial surveillance vendors, the firms selling interception tools to governments, with more attributed exploitation than state-sponsored espionage groups.
Are zero-day attacks getting more common?
The count moves rather than climbs: 100 in 2023, 78 in 2024, 90 in 2025 by Google's tracking. The target has changed more than the volume. Enterprise security and networking products now take almost half the total, while browsers have dropped below a tenth.
Should a small business worry about zero-days?
Worry about the exposure rather than the zero day. Nobody spends six figures on an exploit to reach a ten-person company, but everybody scans the whole internet for unpatched appliances the day an advisory drops. Knowing what of yours is reachable, and patching that first, covers the realistic version of this risk.
On this page
- What Is a Zero Day?
- Why Is It Called a Zero-Day?
- Zero-Day Vulnerability vs Exploit vs Attack
- How a Zero-Day Attack Works
- How Many Zero-Days Are Exploited Each Year?
- Examples of Zero-Day Attacks
- Why Are Zero-Day Vulnerabilities So Valuable?
- How to Protect Against Zero-Day Attacks
- Do Zero-Days Actually Affect You?
Daniel Reyes
Daniel Reyes is a CISSP who spent twelve years in security operations, most recently leading a detection and response team for a mid-sized healthcare group in Texas. He reviews every resource and breach report on Cyber Security Firms for technical accuracy before it publishes.
Most of the people he has trained arrived having been told too much: a dozen acronyms, six vendors, and no clear idea which risk was theirs. His approach is to explain what an attack actually does before naming the tool that stops it, on the basis that most breaches start with something a reader could have recognised.