What is a zero-day vulnerability? A plain-English guide
Zero-days are unpatched security flaws the software vendor doesn't know about yet, making them among the most dangerous bugs in existence.
A zero-day vulnerability is a security flaw in software or hardware that the vendor has had zero days to fix, because they don't know it exists yet. Attackers who find one first can exploit it freely until a patch ships. That window can last days, months, or years.
Why is it called "zero-day"?
The name counts from the vendor's discovery date, not yours. When the vendor learns the flaw exists, they have zero days of advance warning to protect users.
The term originally came from the software-piracy scene, where "zero-day" meant a release cracked on the same day it launched. Security researchers borrowed the phrase because the logic is the same: the defender starts the clock at zero. NIST's glossary defines it as "a vulnerability that is exploited before the software creator has the opportunity to create a patch to fix it."
What makes a zero-day more dangerous than a regular vulnerability?
With a regular, publicly known vulnerability, defenders can apply a vendor patch or a temporary workaround while the patch is being built. A zero-day offers neither option, because the vendor hasn't confirmed the bug yet and no official fix exists.
Security products such as antivirus and intrusion-detection systems (software that watches network traffic for known attack patterns) rely heavily on signatures: fingerprints of previously seen attacks. A brand-new exploit has no signature, so it slips past those defenses. The CISA Known Exploited Vulnerabilities catalog lists flaws that were actively attacked in the wild, and many entries note exploitation preceded the patch by weeks or months.
How does a zero-day go from discovery to patch?
The lifecycle has four rough stages. Researchers or attackers find the flaw. It gets used in attacks or responsibly reported to the vendor. The vendor writes and tests a patch. The patch ships to users.
| Stage | Who acts | User risk |
|---|---|---|
| Flaw exists, unknown to all | Nobody | Low |
| Attacker discovers it | Attacker | High, no defense possible |
| Vendor notified, patch in progress | Vendor | High, no patch yet |
| Patch released, not yet applied | User | High until updated |
| Patch applied | User | Low |
Responsible disclosure, where a researcher tells the vendor privately and waits a set period (commonly 90 days, the deadline Google Project Zero uses) before going public, is designed to shorten the dangerous middle stages.
What does a real zero-day look like?
CVE-2021-44228, commonly called Log4Shell, is a textbook example. It lived inside Log4j, a logging library (a background tool that records events in software) used by millions of applications. The NVD entry gives it a CVSS score of 10.0, the maximum severity rating, and notes it allowed remote code execution, meaning an attacker could run any command on a victim's server across the internet. The flaw was disclosed publicly before many organizations had a chance to patch, turning it into a zero-day for every unpatched system that moment the exploit code became public.
Another example: CVE-2023-28206, an Apple IOSurfaceAccelerator flaw with a CVSS score of 8.6, was confirmed by Apple as exploited in the wild before the patch shipped in iOS 16.4.1. Researcher credit went to Clément Lecigne of Google's Threat Analysis Group.
Who finds and uses zero-days?
Four groups dominate. Independent security researchers hunt them for bug bounties (cash rewards vendors pay for responsible reports). Nation-state intelligence agencies stockpile them for espionage or offensive cyber operations. Criminal groups buy and sell them on private markets. And vendors themselves sometimes discover bugs internally before they become public.
Prices on the commercial vulnerability market vary wildly. A browser zero-day targeting a popular product can fetch hundreds of thousands of dollars, which signals how much operational value attackers place on unpatched flaws.
How do you protect yourself when no patch exists?
Patch speed is still your best lever, because most real-world attacks hit known vulnerabilities long after a patch is available. For genuine zero-days, defense-in-depth helps: network segmentation (splitting your network so a breach in one area can't reach everything else), least-privilege access (users and software get only the permissions they absolutely need), and behavioral detection tools that flag unusual activity rather than known signatures.
CISA's guidance on reducing software vulnerabilities also recommends pressuring software vendors to ship secure defaults and publish memory-safe code, which cuts the attack surface that zero-days exploit in the first place.
Applying patches within 24 to 72 hours of release is the single most effective action for most organizations, because many exploits labeled "zero-day" in headlines are actually targeting systems where a patch existed but was never applied.
Common questions
Is a zero-day the same as an exploit?
No. The zero-day is the underlying flaw. The exploit is the specific code or technique an attacker writes to take advantage of that flaw. A vulnerability can exist without a working exploit, but attackers need the exploit to cause actual harm.
How long do zero-days stay unpatched on average?
Research published by RAND found the average lifespan of a zero-day before discovery or disclosure is roughly 6.9 years, though the range varies enormously by software type and who holds the flaw. High-value government-held bugs can sit undisclosed far longer.
Does "zero-day" mean attackers are already inside my system?
Not automatically. Zero-day describes the vulnerability's disclosure status, not whether you have been attacked. Your exposure depends on whether you run the affected software and whether attackers have targeted your network specifically.
