Zero-Day Vulnerability

A zero-day vulnerability is a security flaw that the software's maker does not know about yet, or has not yet fixed, so users have had "zero days" to patch it. An attack that uses such a flaw is a zero-day exploit.

Zero-days are dangerous because no update exists and antivirus signatures do not recognise the attack. Once the flaw is disclosed and a patch is released, it becomes a known vulnerability, often listed with a CVE number. Defences include installing updates promptly, limiting privileges, network segmentation and behaviour-based detection tools.