What is a zero-day vulnerability?
A zero-day vulnerability is a security flaw that attackers already know about, and may already be using, while the vendor still has no fix available. The name refers to how much time the vendor has had to respond, which is zero days. Three related terms are easy to blur:
- Zero-day vulnerability: the flaw itself.
- Zero-day exploit: code written to take advantage of the flaw.
- Zero-day attack: that exploit used against real targets.
When the vendor ships a patch, the flaw stops being a zero-day and becomes a known vulnerability. Any system that has not applied the update is then an unpatched system.
Who uses zero-days and against what
Finding a zero-day costs a lot, so attackers spend them carefully. The main users are nation-state groups, well-funded criminal gangs and commercial spyware vendors. Edge devices exposed to the internet, such as VPN appliances and firewalls, are popular targets: they sit directly on the internet and seldom run endpoint detection. For defenders the difficulty is that the usual way of closing a hole, installing a patch, is not available when the attack happens.
How to defend against it
Because you cannot patch a zero-day, defense depends on everything else. Reduce the attack surface, since a service that is not exposed cannot be exploited whatever bugs it holds. Segment the network and apply least privilege to limit what an attacker reaches after the first system falls. Use behavior-based detection such as EDR and anomaly detection, which watch what the attacker does once the exploit has run rather than matching a known signature. Apply exploit protections such as DEP and ASLR, use application allow listing, and apply the vendor's interim workaround or a virtual patch, such as an IPS or WAF rule, once details emerge. Patch quickly when the fix arrives, then hunt for signs the flaw was used earlier.
Zero-day vs. known and unpatched vulnerabilities
A zero-day has no fix available yet. A known vulnerability has a published fix, and a system still carrying it is unpatched by choice or neglect. The distinction decides the right answer: for an unpatched system, the fix is to patch; for a zero-day, patching is not yet possible, so the answer is layered defense and the vendor's workaround.
Zero-day vulnerability on the CompTIA Security+ exam
Zero-day sits among vulnerability types under objective 2.4. Phrases such as no patch is available, a previously unknown flaw, or a vendor that has not yet learned of the problem indicate a zero-day. The correct response layers defenses or applies a workaround. Patching the system is wrong because nothing exists to install, and updating antivirus signatures is the classic distractor, because an unknown exploit has no signature. The term also appears on A+ Core 2 (220-1202) objective 2.5 among common threats and vulnerabilities.