Zero-Day
A zero-day is a vulnerability that is not yet known to the vendor and therefore has no patch. A zero-day exploit, or zero-day attack, is an attack that targets such a previously unknown hardware, firmware, or software vulnerability.
Updated
Overview
ASD describes a zero-day exploit as an exploitable software vulnerability that the vendor has not yet disclosed or patched, and the NCSC describes zero-days as weaknesses that were recently discovered and for which no fix or patch was immediately available from the vendor. Once a patch is developed, the vulnerability is no longer considered a zero-day.
Sophisticated threat actors may invest resources in discovering new, previously unknown vulnerabilities in target systems. A zero-day has the advantage of being unknown to the owner of the system or software, but threat actors also target known vulnerabilities in unpatched systems.
Zero-day exploitation has become more routine. In an advisory on the 15 vulnerabilities most routinely exploited in 2023, the NCSC and partners in Australia, Canada, New Zealand, and the United States reported that most were first exploited as zero-days, compared with less than half of the list in 2022.
The advisory's guidance for defenders is vulnerability management: identify all assets in the estate, apply all security updates in a timely manner, and keep situational awareness in operations. It also calls on technology vendors to build secure-by-design products to reduce the risk of vulnerabilities being introduced at the source.
Similar Terms
1 termFrequently Asked Questions
What is the difference between a zero-day vulnerability and a zero-day exploit?→
A zero-day vulnerability is a flaw that is not yet known by the vendor and has not been mitigated by a patch. A zero-day exploit is an attack directed at that vulnerability.
When does a zero-day stop being a zero-day?→
Once a patch is developed, the vulnerability is no longer considered a zero-day.
How common are zero-day attacks?→
Of the 15 vulnerabilities most routinely exploited in 2023, the majority were first exploited as zero-days, according to the NCSC and its partners. In 2022, less than half of that list had been.
How can organizations reduce the risk from zero-days?→
The NCSC and partners advise strong vulnerability management: know every asset, apply security updates promptly once they are released, and keep situational awareness in operations. They also call on vendors to build products secure by design.
Related
Glossary terms
Sources
Definitions follow the government and standards body sources listed above. This site is not affiliated with the agencies or organizations cited.