What is a Zero-Day Vulnerability? Definition, Examples, and Defense

A zero-day vulnerability is a software, hardware, or firmware flaw that is unknown to the vendor at the time attackers discover it, giving defenders zero days to patch before exploitation begins. 

The Google Threat Intelligence Group recorded 90 zero-day vulnerabilities exploited in the wild in 2025, and Mandiant M-Trends 2025 reports exploits as the leading initial infection vector for the fifth consecutive year, at 33 percent of investigated intrusions. 

This article defines a zero-day vulnerability, separates it from related terms, explains the lifecycle, lists current examples, identifies who exploits them, and covers detection and prevention.

What is a Zero-Day Vulnerability?

A zero-day vulnerability is a flaw in software, hardware, or firmware that the vendor does not know about, has not patched, and cannot defend against using existing signatures. The term "zero-day" refers to the number of days the vendor has had to fix the flaw: zero. From the moment an attacker discovers the vulnerability to the moment a patch ships, the window is open.

Three characteristics make a vulnerability a true zero-day. The flaw is unknown to the vendor. No patch exists. Signature-based security tools cannot detect exploitation because no prior indicator has been built into their detection logic. Once any one of these three changes occurs, the vulnerability stops being a zero-day and becomes a known vulnerability with a different defense posture.

The defining feature is the discovery-to-patch window, not the type of flaw. A SQL injection bug, a memory corruption flaw, or a command injection issue can each be a zero-day. The category that matters is timing: the vendor has had zero days to respond.

Zero-Day Vulnerability vs. Zero-Day Exploit vs. Zero-Day Attack

These three terms are not interchangeable, and conflating them blurs the security conversation. The table below separates the flaw, the weaponized code, and the use of that code against a target.

Getting the terminology right matters operationally. A vulnerability disclosure does not always mean an exploit exists. An exploit in a research lab is not the same as an attack in the wild. Security teams act on each differently.

Zero-Day vs. N-Day vs. One-Day Vulnerability

Three timing categories describe a vulnerability's public status, and each carries a different defense posture.

Most exploited CVEs in any given year are N-days, not zero-days. The CISA Known Exploited Vulnerabilities catalog tracks both categories and serves as the authoritative public source for active-exploitation prioritization.

How a Zero-Day Vulnerability Works: The Lifecycle

A zero-day vulnerability moves through six phases from discovery to remediation. Defenders have different intervention points at each phase.

1. Vulnerability Discovery

A researcher, attacker, or bug-bounty hunter identifies the flaw. Discovery can happen through fuzzing, reverse engineering, source-code review, or accidental observation. If a researcher finds it first and reports responsibly, the flaw enters coordinated disclosure. If an attacker finds it first, the next phase begins immediately.

2. Exploit Development

The attacker writes code that weaponizes the flaw into a working exploit. Development effort varies from hours to months, depending on flaw complexity and exploitation difficulty. Mature threat actors maintain libraries of partial exploits they refine when a new vulnerability surfaces.

3. Exploitation in the Wild

The attacker uses the exploit against real targets while the vendor remains unaware. This is the true zero-day window, where signature-based defenses fail, and behavioral detection becomes the primary control. Targets are often chosen for intelligence value, financial return, or strategic access into downstream environments.

4. Public Disclosure

The vendor learns of the flaw through a researcher's report, an incident response investigation, threat intelligence, or public proof-of-concept code. Disclosure may be coordinated with the vendor or forced by an in-the-wild incident. A CVE identifier is assigned, and the flaw enters public catalogs, including the CISA KEV list if active exploitation is observed.

5. Patch Release

The vendor develops, tests, and ships a fix. Time-to-patch ranges from emergency same-day releases to weeks for complex flaws. The vulnerability now transitions from a zero-day to a one-day, then to an N-day as time passes since disclosure.

6. Post-Patch Exploitation (N-Day Window)

Attackers reverse-engineer the patch to confirm the flaw and target organizations that have not yet applied the fix. Mandiant observed more than a dozen separate threat groups exploiting CVE-2024-3400 within two weeks of disclosure, including a RansomHub affiliate that used it as an initial access vector. The N-day window often produces more victims than the original zero-day window.

Why Zero-Day Vulnerabilities Are Dangerous

Five characteristics make zero-day vulnerabilities the most severe class of software flaws enterprises face.

• No patch exists during the exploitation window. Defenders cannot remediate the root cause. Compensating controls reduce but do not eliminate exposure.
• Signature-based tools miss them. Antivirus, intrusion detection systems, and signature-driven EDR rely on indicators that do not exist for unknown flaws.
• They are the leading initial attack vector. Mandiant M-Trends 2025 records exploits as the number-one initial infection vector for the fifth consecutive year, accounting for 33 percent of investigated intrusions.
• Enterprise edge devices are the primary target. The Google Threat Intelligence Group 2024 report found 44 percent of zero-day exploits target enterprise platforms, with 60 percent of those hitting security and networking appliances such as VPNs and firewalls.
• Detection delays extend the damage. The longer a zero-day remains unknown, the more environments are compromised before the vendor ships a patch. Three of the four most-exploited vulnerabilities in 2024 were zero-days in security products, per Mandiant.

Common Zero-Day Vulnerability Examples (2023 to 2025)

Six recent zero-day incidents show how exploitation patterns have shifted toward enterprise edge devices, file-transfer platforms, and security appliances.

• MOVEit Transfer (CVE-2023-34362). Cl0p ransomware exploited a SQL injection zero-day in Progress Software's MOVEit Transfer starting May 27, 2023, deploying the LEMURLOOT web shell on internet-facing instances. Emsisoft tracked 2,600+ affected organizations and more than 77 million exposed individuals.
• Palo Alto Networks PAN-OS GlobalProtect (CVE-2024-3400). A CVSS 10.0 command injection zero-day in the GlobalProtect VPN gateway allowed unauthenticated remote code execution with root privileges. Multiple threat groups, including a RansomHub affiliate, weaponized the flaw within two weeks of disclosure.
• Ivanti Connect Secure (CVE-2023-46805 and CVE-2024-21887). An authentication bypass chained with a command injection zero-day in Ivanti VPN appliances. State-sponsored groups exploited the chain to deploy web shells and conduct lateral movement before patches shipped.
• Fortinet FortiClient EMS (CVE-2023-48788). A SQL injection zero-day in Fortinet's endpoint management server. Multiple ransomware affiliates used the flaw as an initial access vector against enterprise environments.
• Microsoft Windows CLFS (CVE-2024-49138). A privilege escalation zero-day in the Windows Common Log File System driver. Ransomware operators used the flaw to elevate from an initial foothold to administrator privileges.
• Apple WebKit and iOS (multiple 2024). Commercial surveillance vendors used WebKit zero-days to deliver spyware against journalists, dissidents, and political targets across multiple campaigns disclosed during 2024.

Who Discovers and Exploits Zero-Day Vulnerabilities?

Four actor categories drive zero-day discovery and exploitation, and the 2025 GTIG data shifted significantly between them.

• Commercial surveillance vendors. Private companies that sell spyware and exploit chains to government customers. The Google Threat Intelligence Group 2025 report attributed 34.9 percent of zero-day exploits to commercial surveillance vendors, the largest single category that year.
• State-sponsored threat actors. Intelligence and military units from China, Russia, North Korea, and Iran. GTIG attributed 27.9 percent of 2025 zero-day exploitations to state-sponsored groups, often used for espionage, prepositioning, and disruption.
• Financially motivated cybercriminals. Ransomware groups, initial access brokers, and data extortion crews. Mandiant M-Trends 2025 found that 55 percent of active threat groups in 2024 were financially motivated, a steady year-over-year increase.
• Independent security researchers. Discover and disclose flaws through coordinated vendor channels, bug bounty programs, and competitions, including Pwn2Own and the Zero Day Initiative. Responsible disclosure shrinks the zero-day window before exploitation begins.

How to Detect a Zero-Day Vulnerability

Zero-day detection cannot rely on signatures because no signature exists. Five methods together give security teams meaningful early warning.

1. Behavioral Analysis and Anomaly Detection

EDR and XDR platforms detect exploitation behavior rather than the specific exploit. Process injection, unexpected child processes, privilege escalation, and unusual outbound connections from trusted processes all indicate exploitation regardless of whether the underlying vulnerability is known. Behavioral detection is the single most effective control during the zero-day window.

2. Threat Intelligence on Actively Exploited CVEs

Threat intelligence feeds track zero-day exploitation campaigns and emerging proof-of-concept code, often providing warning days before a patch ships. The CISA Known Exploited Vulnerabilities catalog is the authoritative public source for confirmed in-the-wild exploitation.

3. External Attack Surface Monitoring

Continuous scanning of an organization's internet-facing assets identifies which systems are exposed to a newly disclosed vulnerability within hours of disclosure. Knowing the exposure scope is the prerequisite for emergency patching decisions.

4. Dark Web and Threat Actor Monitoring

Underground forums, encrypted channels, and exploit marketplaces surface zero-day chatter and proof-of-concept code before broad disclosure. Monitoring these sources gives advance warning of weaponization that public threat feeds will not show.

5. Network Traffic and Log Analysis

Anomalies in firewall, proxy, DNS, and authentication logs catch exploitation traffic that bypasses endpoint controls. Volume spikes, unusual destinations, protocol misuse, and authentication outliers each indicate possible exploitation.

How to Prevent and Mitigate Zero-Day Vulnerabilities

Seven controls form the modern zero-day defense framework. No single control prevents exploitation; a layered application narrows the window and limits the blast radius.

1. Continuous Vulnerability and Patch Management

Apply patches the day they ship to close the N-day window. Automated patch deployment with ring-based approval workflows balances speed against stability testing.

2. Behavioral EDR and XDR Deployment

Behavioral detection catches exploitation patterns before signatures exist for the specific vulnerability. EDR is the primary technical control during the true zero-day window.

3. Network Segmentation and Zero Trust

Segmentation limits the blast radius when a zero-day succeeds. An attacker who exploits a zero-day in a workstation should not gain automatic access to domain controllers, file servers, or backup systems.

4. External Attack Surface Monitoring

Continuous discovery and scanning identify which exposed assets a new CVE affects within hours of disclosure. The speed of exposure assessment determines the speed of remediation.

5. Threat Intelligence Integration

Feed actively exploited CVE data into vulnerability prioritization so security teams patch the flaws attackers are actually using, not just the highest CVSS scores. Exploit prediction outperforms theoretical severity ranking.

6. CISA KEV Catalog and Equivalent Prioritization

The CISA Known Exploited Vulnerabilities catalog provides the authoritative list of vulnerabilities under active exploitation. KEV-driven prioritization aligns remediation with real-world attacker behavior.

7. Application Allowlisting and Least Privilege

Allowlisting reduces the impact when an exploit lands by restricting which code can execute. Least-privilege access limits what a compromised process can reach.

How CloudSEK Helps Identify and Disrupt Zero-Day Attack Paths

CloudSEK Threat Intelligence tracks exploited CVEs, monitors dark web and underground discussion of zero-day proof-of-concept code, and delivers AI-curated intelligence on which vulnerabilities threat actors are weaponizing in real time. The platform tracks more than 30,000 threat actors and their TTPs, surfaces ransomware-group activity, and answers a direct question for SOC and threat-intelligence teams: which zero-days are attackers exploiting against my industry right now?

BeVigil identifies which of an organization's external assets are exposed to a newly disclosed CVE across web applications, mobile applications, APIs, cloud, DNS, SSL, and network surfaces. CloudSEK Nexus AI correlates threat intelligence with external attack surface data into validated attack paths, showing exactly how an attacker would chain a zero-day exploit into enterprise systems before execution.

Frequently Asked Questions

What is a zero-day vulnerability in simple terms?

A zero-day vulnerability is a security flaw in software, hardware, or firmware that the vendor does not know about yet. Because no patch exists, attackers can exploit it before any defense is available.

What is the difference between a zero-day vulnerability and a zero-day exploit?

A zero-day vulnerability is the flaw itself. A zero-day exploit is the code or technique that takes advantage of the flaw. The vulnerability is the door; the exploit is the key that opens it.

How are zero-day vulnerabilities discovered?

Zero-day vulnerabilities are discovered through fuzzing, reverse engineering, source-code review, bug-bounty research, accidental observation, and incident response investigations. Attackers and researchers use the same techniques; intent determines what happens next.

How long does a zero-day vulnerability stay unknown?

A zero-day stays unknown from hours to years, depending on flaw complexity, attacker operational security, and detection capability. The Heartbleed flaw existed for two years before public disclosure; some commercial spyware zero-days remain undetected for similar spans.

Can an antivirus detect a zero-day attack?

Signature-based antivirus software cannot detect a zero-day attack because no signature exists for the unknown exploit. Behavioral EDR, XDR, and anomaly detection catch exploitation patterns even when the specific vulnerability is unknown.

What is the difference between zero-day and N-day vulnerabilities?

A zero-day is unknown to the vendor, with no patch available. An N-day is a known vulnerability disclosed N days ago for which a patch exists but has not yet been deployed everywhere. Most exploited CVEs in any year are N-days.

Who buys and sells zero-day exploits?

Commercial surveillance vendors, government intelligence agencies, exploit brokers, and bug-bounty programs make up the zero-day market. GTIG 2025 attributed 34.9 percent of attributable zero-day exploitations to commercial surveillance vendors and 27.9 percent to state-sponsored groups.