A zero-day vulnerability is a hidden security flaw that attackers may exploit before a patch is available. If you manage a device, work online, or rely on connected services, the threat can feel hard to judge. You may not know a flaw exists until someone uses it or a vendor shares an alert.
That uncertainty matters to people and organizations. A flaw can put private data, business systems, and public services at risk, yet no single defense can prevent every attack. Understanding the terms helps you read security news and make practical choices about exposure. Knowing the difference between the flaw and the attack helps you make sense of security alerts.
Key Takeaways
- A zero-day describes a flaw that lacks a fix when attackers can use it.
- An exploit is the method used to take advantage of the flaw.
- An attack is the real-world use of that method against a target.
- Zero-days can affect software, hardware, firmware, and settings.
- Limited access, monitoring, and prompt patching can reduce harm.
What Is a Zero-Day Vulnerability?
A zero-day vulnerability is a security flaw that its vendor does not yet know about or cannot yet fix. Zero-day refers to the time developers have had to prepare a patch before the flaw is exploited.
While the flaw remains unknown and unfixed, no official patch is available. The status can change when a vendor learns about the issue, releases a patch, or shares a workaround.
Zero-day describes a flaw’s status, not a promise that attackers will use it.
The name does not point to a specific coding mistake. A coding error or design weakness can become a zero-day flaw, but its unknown or unpatched status is what matters.
A practical teaching grouping includes four types: software, hardware, firmware, and configuration flaws. This grouping helps you sort risks, but it is not a universal taxonomy.
A software flaw might affect an app or operating system. Hardware flaws involve physical components, while firmware flaws affect the low-level code that helps devices run.
Configuration flaws arise from settings that expose a service or give users more access than they need. A flaw in any group can affect individuals, companies, or public services.
For example, a flaw in a widely used product can affect many systems, even when each owner has different security tools. The zero-day definition hinges on vendor knowledge and the availability of a fix.
The label describes the flaw’s status, not how severe its consequences will be.
How Do Vulnerability, Exploit, and Attack Differ?
The vulnerability is the weakness, the exploit is the method, and the attack is the attempt to use that method against a target. Those terms mark different parts of one security event.
A zero-day vulnerability is the flaw, a zero-day exploit is the technique or code, and a zero-day attack is its real-world use before a patch is available. Keeping the terms separate makes security reports easier to read.
The flaw, the method, and the event
A vulnerability might be a flaw in an app, device, or service. An exploit can be code or a sequence of actions that takes advantage of that weakness.
A crafted request that abuses a software flaw is one example of an exploit. An attacker sending that request to a target is carrying out an attack.
| Term | What it means | Example |
|---|---|---|
| Zero-day vulnerability | The weakness | A flaw in software or a device |
| Zero-day exploit | The technique or code | A crafted request that abuses the flaw |
| Zero-day attack | The real-world attempt or compromise | An attacker using the exploit against a target |
How CVEs and n-day flaws fit
CVE means Common Vulnerabilities and Exposures, a standardized identifier used to track a specific publicly documented vulnerability. A CVE may be assigned after discovery.
A CVE is an identifier, not a synonym for zero-day. A vulnerability may have a CVE and still have been a zero-day before public disclosure or patching.
An n-day vulnerability has been publicly disclosed and may have a patch. Systems that remain unpatched can still face danger from an n-day flaw.
That distinction matters when a report names a CVE but does not say whether a patch is ready. The number helps people refer to the same weakness; it does not describe every system’s exposure.
A CVE number identifies a vulnerability, while zero-day describes its disclosure and patch status.
How Does a Zero-Day Attack Work?
An attack begins when someone uses an exploit against a system that still contains the flaw. The route in can involve a user, a file, or a network connection.
A zero-day attack uses an exploit to reach a target before a patch is available. The steps can vary, but the attacker still needs a way to reach a vulnerable system.
From discovery to a foothold
A common attack path has four steps:
- Discover the flaw or obtain knowledge of it.
- Develop an exploit or acquire one from someone else.
- Find targets that contain the flaw and can be reached.
- Exploit the flaw to pursue an objective.
A phishing attachment or malicious file may ask a user to open it or run code. A crafted network request can target an exposed service without requiring that interaction.
An attacker may seek code execution, unauthorized access, higher privileges, or disruption of normal operations. The result depends on the flaw and the system’s safeguards.
A VPN can protect traffic routed through its connection, but it cannot stop every phishing message or malicious download. See this guide to free VPN privacy limits for a closer look at what that tool can and cannot do.
What an attacker can do after entry
Once inside, an attacker may install malware, steal data, or disrupt services. A foothold can also help the attacker reach other systems if access controls are weak.
Some attacks stay quiet to avoid notice, while others disrupt a service right away. A user may see a file open or an app behave oddly, but some compromises leave few obvious signs.
Security teams can investigate unusual access, new processes, or changes to normal system activity. A lack of a known threat alert does not prove a system is safe.
Reports of zero-day attacks may describe different goals, from data theft to service disruption. The initial flaw does not dictate what an attacker will do after entry.
Treat unexpected access or behavior as a reason to investigate the affected system, even when no alert names a known threat.
Why Are Zero-Day Attacks Dangerous?
The main danger is the window in which attackers can act before defenders have a patch or reliable indicators. That window can leave security teams with less time to spot or block an attack.
While a flaw remains a zero-day, no patch is available by definition. Zero-day exploits can be dangerous, but most cyberattacks are believed to use known vulnerabilities rather than zero-days.
The patch gap gives attackers an early opportunity
Defenders may not know what behavior to watch for until researchers or vendors study the flaw. A security product may also lack a rule for a new exploit.
Once a vendor releases a patch, teams still need to identify affected assets and install the update. Systems that miss the update can remain exposed after public disclosure.
Unknown flaws are only one part of the wider threat picture. Weak access controls, exposed services, and old software can also give attackers a way in.
What observed figures say about exploitation
Researchers observed 55 zero-day vulnerabilities in use in 2022, down from 81 in 2021. In 2024, 44% of zero-day exploits targeted enterprise security tools.
| Measure | Period | Value | What it indicates |
|---|---|---|---|
| Observed zero-days in use | 2021 | 81 | Higher observed count than the following year |
| Observed zero-days in use | 2022 | 55 | Lower observed count than 2021 |
| Zero-day exploits aimed at enterprise security tools | 2024 | 44% | A notable enterprise target area |
The European Union Agency for Cybersecurity found that vulnerability exploitation drove 21.3% of observed intrusion vectors in its 2025 threat landscape report. That figure covers vulnerability exploitation generally, not zero-day attacks alone.
The observed zero-day figures show why these flaws draw attention, but they do not make zero-days the usual cause of every breach.
A high-impact possibility does not mean zero-days account for most attacks.
The ENISA Threat Landscape 2025 reports that vulnerability exploitation accounted for 21.3% of observed intrusion vectors.
Who Uses Zero-Days and What Do They Target?
Zero-day attackers range from state-linked operators and cybercriminals to insiders with access to a system. Their motives differ, from spying and financial gain to causing harm.
Zero-day use is not limited to one kind of threat actor. A state-linked group may seek intelligence, a criminal may seek money, and a malicious insider may misuse legitimate access.
Google’s Threat Intelligence Group documented Chinese state-linked hackers exploiting seven zero-day vulnerabilities in cyberoperations in 2022. That case shows one use of zero-days, not the full range of attackers.
Targets can include government agencies, public administrations, enterprises, and individuals. The right target depends on the attacker’s goal and the systems it can reach.
Widely deployed products can make one flaw relevant to many organizations. An externally reachable service can raise exposure because attackers may target it over a network.
The attack surface is the set of systems and services an attacker might reach. A public server, a staff laptop, and a connected device can each add to that surface.
Some attackers want access to a high-value organization, while others seek many vulnerable devices. A flaw in a common product can serve either aim.
Organizations need to understand which products they use and where those products connect. An organization’s exposure depends partly on whether affected technology is present and reachable in its environment.
What Are Notable Real-World Zero-Day Examples?
Stuxnet shows how a zero-day exploit can reach beyond ordinary office software and affect physical processes. Its target was unusual: industrial control systems that operate machinery.
Stuxnet is one of the best-known zero-day examples, but it is not the only major case. Later attacks affected SharePoint servers and web browsers.
Stuxnet targeted industrial control systems
Stuxnet was first uncovered on June 17, 2010, and is thought to have been in development since at least 2005. It used four zero-day flaws against Windows computers and Siemens Step7 software.
The malware targeted programmable logic controllers, including systems used in industrial processes such as gas centrifuges. It could enter through an infected USB flash drive and cross an air gap.
An air gap separates a computer or network from outside connections. An infected USB drive can carry malware across that gap when someone connects the drive to a protected system.
Stuxnet reportedly compromised Iranian controllers and caused fast-spinning centrifuges to tear themselves apart. It infected more than 200,000 computers, physically degraded 1,000 machines, and reportedly destroyed almost one-fifth of Iran’s nuclear centrifuges.
SharePoint ToolShell affected exposed servers
In 2025, attackers used Microsoft SharePoint vulnerability CVE-2025-53770, known as ToolShell. They compromised more than 75 servers before an emergency patch was issued.
The ToolShell attack affected U.S. public administrations and other organizations. Exposed servers gave attackers a path into systems that relied on the affected product.
Browser vulnerabilities identified in 2025
Gatewatcher identified browser zero-days CVE-2025-5419, CVE-2025-6554, and CVE-2025-6558 as discovered and exploited in 2025. The three identifiers point to separate vulnerabilities.
| Example and year | Target | Zero-day detail | Observed impact |
|---|---|---|---|
| Stuxnet, uncovered 2010 | Windows, Siemens Step7, industrial controllers | Four flaws and an infected USB route | More than 200,000 computers infected, 1,000 machines degraded, and almost one-fifth of Iran’s nuclear centrifuges reportedly destroyed |
| ToolShell, 2025 | Microsoft SharePoint servers | CVE-2025-53770 | More than 75 servers compromised before an emergency patch |
| Browser flaws, 2025 | Browsers | CVE-2025-5419, CVE-2025-6554, and CVE-2025-6558 | Identified as discovered and exploited |
A single exposed product can put multiple organizations at risk until they can apply a fix or limit access.
How Can Organizations Reduce Zero-Day Risk?
The practical goal is to limit what an attacker can reach if a system is compromised. That matters before a fix exists, because no patch is available while a flaw remains a zero-day.
Access limits, network separation, and behavior monitoring can reduce harm without guaranteeing that an unknown flaw will be blocked. These controls help contain an attack or spot unusual activity.
Limit the reach of a successful exploit
Start with an accurate inventory of systems and services that face the public internet. Teams cannot assess exposure if they do not know which assets they own.
- Maintain an accurate inventory of exposed assets.
- Use least-privilege access, so each account has only needed rights.
- Require multifactor authentication for accounts and remote access.
- Segment networks and systems to limit movement between them.
- Monitor abnormal behavior with endpoint detection and response.
Least privilege can limit what a stolen account can reach. Multifactor authentication adds a check beyond a password, while network segmentation can keep one affected system apart from others.
Keep detection and patching in the defensive mix
Endpoint detection and response tools watch devices for suspicious activity. Security teams can review unusual processes, connections, or changes rather than relying only on known threat signatures.
These controls reduce exposure, but they cannot guarantee that every unknown flaw will be blocked. A VPN also protects only traffic routed through it, not every app, account, or device.
For more on reducing data exposure through outside support workflows, see this account of EY support platform data. The case also shows why access to sensitive records matters beyond an organization’s own systems.
The CISA advisory on weak security controls covers risks such as missing multifactor authentication and exposed services.
Apply a released vendor patch promptly, while keeping access controls and monitoring in place.
How Should Organizations Respond Before a Patch Exists?
Start by finding whether the affected product or service is present and exposed in your environment. Fast confirmation helps teams focus their response on systems that need action.
Use temporary limits to lower exposure, then deploy the official patch when the vendor releases it. A patch is not available by definition while a flaw remains a zero-day.
Confirm exposure and restrict access
A newly disclosed or actively exploited flaw calls for a clear response. Security teams can use this five-step process:
- Identify affected products and versions across owned assets and critical third parties.
- Check vendor and government advisories for known exposure and guidance.
- Restrict or disable vulnerable services when feasible.
- Increase monitoring and record mitigation decisions.
- Prioritize the official patch when released and verify deployment across affected systems.
Product names alone may not be enough to confirm exposure. Teams need to check versions and the way affected services connect to other systems.
Apply the fix and verify coverage
Temporary access restrictions, firewall rules, or service shutdowns can lower risk while a patch is unavailable. These are compensating controls, not replacements for a vendor fix.
Record which systems have temporary limits and who approved them. That record helps teams remove temporary rules safely after the official patch is installed.
When the patch arrives, test it as needed and deploy it across affected systems. Check dependent systems too, including devices or services managed by a third party.
Confirm patch coverage across dependent systems instead of treating publication of an update as completed remediation.
How Do Zero-Days Differ From Other Cyber Threats?
A Trojan horse is a type of malware disguised as legitimate-looking content, while a zero-day is an unpatched flaw. The terms describe different things: one is a malware disguise, and the other is a weakness.
A distributed denial-of-service (DDoS) attack aims to disrupt availability by overwhelming a target’s network, server, or application with traffic or requests. A DDoS attack does not, by definition, exploit an unknown software flaw.
Trojan horses can look like legitimate software
A Trojan horse can hide in an email, attachment, advertisement, pop-up, or website link. It typically needs a user to download and install the malicious program.
The infected device may seem to work normally until a user action activates the malware. Its payload may steal data or disrupt activity after installation or activation.
The disguise is a delivery tactic, not a kind of vulnerability. A Trojan horse may use a known flaw or no software flaw at all to reach a device.
DDoS attacks aim to disrupt availability
A DDoS attack overwhelms a service with traffic or requests, making it slow or unavailable to users. The target may be a network, server, or application.
That goal differs from using a zero-day exploit to gain access or run code. A DDoS attack can occur alongside other malicious activity, but its central aim is to disrupt service.
A zero-day names an unknown or unpatched weakness, while Trojan horse and DDoS describe different attack features.
These terms can appear together in a security report, but they are not interchangeable. A malware disguise, a flaw, and an attempt to overwhelm a service describe separate parts of a threat.
The key distinction is whether the term describes a weakness, a malware disguise, or an attempt to make a service unavailable.
Conclusion
A zero-day vulnerability is difficult to predict, but its impact can be limited. You may not be able to prevent a flaw before discovery, yet good visibility, limited access, and network separation can reduce harm.
Timely patching matters once a vendor releases a fix. Security teams also need a clear way to assess exposure and decide who will act during an urgent alert.
Check your organization’s asset inventory and make sure your team knows how to act when a vendor releases an urgent security update.
FAQ
Why are they called zero-day vulnerabilities?
They are called zero-day vulnerabilities because developers have had zero days to prepare a patch before exploitation. The name refers to the time available to respond, not the flaw’s age or severity. Once a vendor learns about the issue, the flaw may still lack a fix. A public disclosure or patch can change its status.
What are the four types of vulnerability?
A practical grouping includes software, hardware, firmware, and configuration flaws. Software flaws affect programs, while hardware flaws involve physical components. Firmware flaws affect low-level code that helps a device run. Configuration flaws come from risky settings. This grouping helps explain common cases, but it is not a universal taxonomy used by every security team.
What is the term for a cyber attack that exploits a software vulnerability that is unknown by software vendors?
It is a zero-day attack when an attacker uses an exploit against a flaw before a patch is available. The vulnerability is the weakness, while the exploit is the method used to take advantage of it. The attack is the real-world attempt or compromise. These terms help separate the flaw from what an attacker does with it.
What is the most famous zero-day exploit?
Stuxnet is one of the best-known zero-day examples, though there is no uncontested single winner. It used four zero-day flaws and targeted Windows computers and Siemens Step7 software linked to industrial systems. It could also reach protected systems through an infected USB drive. Its reported impact included damage to Iranian nuclear centrifuges.
Can a zero-day vulnerability affect hardware?
Yes, a zero-day vulnerability can affect hardware, firmware, or software. The term describes a flaw’s status, not the type of technology that contains it. A hardware or firmware flaw may affect devices even when their apps are up to date. The key issue is whether the vendor knows about the flaw or has a fix ready.
Are most cyberattacks caused by zero-day vulnerabilities?
No, most cyberattacks are believed to use known vulnerabilities rather than zero-days. A known flaw can still pose a serious risk when systems have not received the available patch. Attackers may also exploit weak access controls, exposed services, or stolen passwords. Zero-days draw attention because defenders may have less time to respond.
Can organizations reduce the damage from a zero-day attack before a patch is ready?
Yes, organizations can limit damage before a patch is ready. Least-privilege access, multifactor authentication, network segmentation, and abnormal-behavior monitoring can reduce an attacker’s reach or help teams spot unusual activity. These measures do not guarantee that an unknown flaw will be blocked. They can help contain an attack while teams wait for a vendor fix.
