What Is a Zero-Day Vulnerability?

Last verified on Nov 8, 2026.

A zero-day vulnerability is a flaw that attackers can use before a fix exists. NIST's glossary defines a zero-day attack as an attack that exploits a previously unknown hardware, firmware, or software vulnerability. The name comes from the defender's side: you have had zero days to prepare.

The defining fact is timing, not severity. A zero-day can be minor, and once the vendor discloses it and ships a fix, the term usually stops applying even if you have not patched.

Vulnerability, Exploit, Attack

The three words get mixed up, so keep them apart:

Once the vendor ships a fix, the same flaw is a known, patchable vulnerability. Attackers can keep using it against systems that have not updated, and the CISA KEV catalog tracks exactly that kind of exploitation.

How a Zero-Day Becomes a CVE

The CVE Program describes the path. A person or organization discovers a vulnerability, a CVE Program partner assigns an ID, and the ID is reserved. The Reserved state means stakeholders are using it for early-stage coordination while the CNA is not yet ready to disclose publicly. Once the CNA submits the details, including at least one public reference, the record is published.

For a zero-day exploited in the wild, the order can flip: attacks are seen first, then a record. cve.now's documentation notes that many incidents become public long before a CVE record does, and some never get one. A CVE ID, when it arrives, is what lets advisories, scanners, and your tickets refer to the same flaw.

Defending When There Is No Patch

No patch means you reduce what an attacker can reach and watch for what they do next. In rough order of payoff:

1. Remove exposure. Take the affected service off the internet or put it behind a gateway. CISA's directive BOD 26-04 treats whether an asset is publicly exposed as a deciding factor in how fast to act.
2. Apply the vendor's mitigation or workaround. CISA's KEV criteria accept mitigations and workarounds as a clear remediation action, so vendors often publish one before a full patch.
3. Narrow what the service can do. Limit its outbound network access and its credentials, so a compromise cannot reach far. This also limits lateral movement.
4. Watch for behavior, not signatures. A zero-day has no known payload to match, so look for the effects: a web server spawning a shell, a new outbound connection from a service that never made one, a new admin account.

The behavioral checks map to existing guides: novel events, unusual data egress, and privilege changes. The exposure guide covers step 1.

When a Zero-Day Is Confirmed Exploited

CISA's KEV criteria require reliable evidence of exploitation, which includes attempted exploitation, plus a clear remediation action. A confirmed zero-day with a workaround can therefore be listed before a patch exists. KEV does not count scanning or a public proof of concept alone. Once a CVE is listed in KEV, treat it as exploited and investigate your logs as well as patching.

Early Warnings on cve.now

cve.now, a free vulnerability feed from Sazabi, lists incidents that have no CVE yet, including exploited zero-days, as early warnings. Each shows its sources and a confidence level (confirmed, corroborated, or unverified). Open cve.now early warnings. Sazabi, an AI-native observability and security platform, also scans connected repositories for vulnerabilities through its security review, which files confirmed findings as issues.

Frequently Asked Questions

What is a zero-day vulnerability in simple terms?

A flaw in software or hardware that attackers can use before the vendor has a fix, or before the vendor even knows about it. Defenders have had no time to patch.

What is the difference between a zero-day vulnerability, exploit, and attack?

The vulnerability is the flaw. The exploit is the code or technique that uses it. The attack is the exploit used against a target. NIST defines a zero-day attack as one that exploits a previously unknown vulnerability.

Does a zero-day have a CVE?

Often not at first. Incidents can become public before a CVE record is published. Once the vendor discloses, a CNA publishes a record and the ID can be used in advisories and the KEV catalog.

How do you protect against a zero-day?

You cannot patch what has no patch, so limit exposure, apply any vendor workaround, restrict what the affected service can reach, and watch logs for the behavior that follows exploitation.

Sources

1. NIST glossary defines a zero-day attack as an attack that exploits a previously unknown hardware, firmware, or software vulnerability (CNSSI 4009-2022, NISTIR 8011 Vol. 3) (accessed Nov 8, 2026)
2. KEV requires a clear remediation action, which includes a mitigation or a workaround, and counts attempted exploitation but not scanning or proof of concept alone (accessed Nov 8, 2026)
3. A Reserved CVE ID means stakeholders are coordinating before the CNA discloses the vulnerability publicly; a record is published once minimum data, including a public reference, is submitted (accessed Nov 8, 2026)
4. Many incidents become public before a CVE record does, such as exploited zero-days; cve.now lists them as early warnings with sources and a confidence level (accessed Nov 8, 2026)
5. Threat actors exploit unpatched vulnerabilities, and the directive ties remediation urgency to exposure, KEV status, automation, and technical impact (accessed Nov 8, 2026)