Zero-day
noun · also 0-day, Zero-day vulnerability · NIST CSRC Glossary
A vulnerability that attackers exploit before the vendor has released a fix, so defenders have had zero days to patch it.
A zero-day is a software flaw that is unknown to the vendor, or known but not yet fixed, while attackers are already able to exploit it. The name refers to the number of days defenders have had to respond: none. Once a patch is released, the vulnerability is no longer a zero-day, but it remains dangerous for every system that has not been updated.
Zero-days are valuable, so they are used selectively, often by advanced groups against high-value targets. After public disclosure, however, exploitation usually spreads quickly to criminal groups who scan the internet for anyone still unpatched. CISA's Known Exploited Vulnerabilities (KEV) catalog tracks vulnerabilities confirmed to be exploited in the wild.
Example
In May 2023, a criminal group exploited a previously unknown SQL injection flaw in the MOVEit Transfer file-transfer product to steal data from hundreds of organizations before a patch was available. Many victims learned about the attack only when their stolen files were posted online.
Why it matters for a SOC analyst
You cannot patch a zero-day, so defense depends on everything else: limiting what is exposed to the internet, segmenting networks, and detecting the attacker's behavior after the exploit, such as new web shells, unusual child processes of server software or large outbound transfers. When a zero-day affecting your software is announced, hunt for signs of compromise from before the announcement, not just from today onward.
Related terms
- Supply chain attack
Compromising a trusted supplier, software update or library to reach its customers, who install the malicious code believing it is legitimate.
- Advanced persistent threat
A well-resourced, often state-backed group that targets specific organizations and works to stay hidden in their networks for months or years.
- Worm
Malware that copies itself from system to system on its own, usually by exploiting a vulnerability, without any user action.
- Threat intelligence
Information about threats and threat actors, collected and analyzed so that an organization can make better security decisions.