Cybersecurity glossary
What is a Zero-Day Exploit?
Learn what a zero-day exploit is, how 0-day vulnerabilities differ from n-day bugs, who uses them, detection challenges, and how organizations reduce zero-day risk.
Definition
A zero-day exploit is attack code that takes advantage of a previously unknown software vulnerability—one for which the vendor has had “zero days” of public notice to develop and distribute a patch—often used before defenders can apply mitigations.
Why zero-days dominate headlines
Most breaches use known bugs, stolen credentials, or misconfigurations. A zero-day exploit is different: defenders have no CVE-linked patch to apply yet. That asymmetry makes zero-days valuable to advanced attackers and terrifying in press coverage—even though they are not the most common failure mode.
Zero-day vs related terms
| Term | Meaning |
|---|---|
| Zero-day vulnerability | A flaw unknown to the vendor/public |
| Zero-day exploit | Working attack code for that unknown flaw |
| N-day | Known flaw exploited before or during slow patching |
| Exploit chain | Multiple bugs combined for sandbox escape or privilege gain |
Typical zero-day lifecycle
Discovery
A researcher or adversary finds a novel bug in software or firmware.
Weaponization
Reliable exploit code is developed—sometimes sold or stockpiled.
Quiet exploitation
Targeted attacks may occur before any public awareness.
Disclosure or detection
Vendor notification, crash analysis, or threat intel reveals the issue.
Patch and residual risk
Fixes ship; n-day exploitation continues against unpatched systems.
Practical defenses (no silver bullet)
Shrink attack surface
Remove unused services, browsers plugins, and exposed admin paths.
Exploit mitigations
ASLR, CFG, sandboxing, memory-safe languages where feasible.
Detection & response
EDR, logging, and practiced IR catch post-exploit behavior.
Rapid patching culture
When zero-days become n-days, speed decides outcomes.
- Inventory internet-facing and high-risk client software continuously.
- Subscribe to CISA KEV and vendor advisories; patch aggressively.
- Segment critical systems so one client exploit is not domain-wide compromise.
- Deploy EDR/XDR and retain forensic logs before you need them.
- Use least privilege and application allowlisting on sensitive endpoints.
- Prefer vendors with strong security response and short patch SLAs.
- Run tabletop exercises for “unknown exploit in the wild” scenarios.
- Remember: most preventable risk is still known vulns and weak identity—not 0-days.
The practical takeaway
A zero-day exploit weaponizes a vulnerability before a patch exists. You cannot patch what is unknown—but you can reduce exposure, detect post-exploit activity, and crush n-day risk when disclosure arrives.
Build for resilience: assume sophisticated attackers exist, and make every compromise expensive, noisy, and containable.
Related security terms
Exploit Chain
Zero-days are often combined with other bugs for full compromise.
Remote Code Execution (RCE)
A common high-impact outcome of many zero-day exploits.
Web Application Firewall (WAF)
Can provide temporary virtual patching once indicators are known.
Memory Corruption
A frequent root-cause class behind client and browser zero-days.
Frequently asked questions
What is a zero-day exploit in simple terms?
It is an attack that uses a software bug the vendor and public do not know about yet—so there is no official patch available.
Is “zero-day” the bug or the exploit?
People say both. Strictly, the vulnerability is a zero-day vulnerability; the working attack code is the zero-day exploit.
What is an n-day?
An n-day is a known vulnerability being exploited after disclosure—often before all systems are patched.
Who uses zero-days?
Nation-state actors, sophisticated cybercrime groups, and occasionally researchers demonstrating impact. They are expensive and rare relative to commodity malware.
Can antivirus stop zero-days?
Signature AV often cannot. Behavior detection, sandboxing, exploit mitigations, and least privilege improve odds but are not guarantees.
How should organizations prepare?
Rapid patching, attack-surface reduction, layered controls, logging/EDR, segmentation, and practiced incident response—not waiting for perfect prevention.
References
Explore authoritative guidance and frameworks related to zero-day exploit.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.