What is a zero-day vulnerability?

The term marks a period rather than a technique.

There is a moment when a weakness becomes usable by somebody, and a later moment when a correction exists and can be applied. Between those two, any use of it is a zero-day, whether the method is ingenious or completely routine. After the second moment, the same attack against an unpatched system is no longer called that, though it works as well.

That is the whole of the definition, and the interesting consequences follow from how narrow it is.

A zero-day goes through a few stages. Someone finds the flaw: an attacker, a researcher, or the vendor's own staff. Then, in the better case, it is reported to the vendor privately, which starts work on a fix; in the worse case, it is used or sold first, and the vendor learns about it from an attack.

Day zero is the day the vendor learns of the flaw, or the day it becomes public, with no fix ready. Once a fix ships, the flaw is a known vulnerability, sometimes called an n-day, and the question changes from whether a fix exists to whether it has been applied.

The three phrases describe three different things. The vulnerability is the weakness itself. A zero-day exploit is code or a technique that uses that weakness. A zero-day attack is an exploit used against a real target before a fix exists.

The distinction matters for defence. A vulnerability can sit unknown for years and harm nobody; an exploit makes it usable; an attack is the moment it costs someone something. Filtering in front of an application can make an exploit harder to deliver, which is what virtual patching means, while the vulnerability stays in place until the vendor ships a fix.

Three consequences, and the third is the one to act on.

• The label says nothing about difficulty. An unremarkable technique against a weakness nobody has fixed qualifies just as much as an elaborate one. Treating the word as a measure of sophistication leads to overestimating the attacker and underestimating how ordinary the exposure usually is.
• Most damage happens after the fix exists. The window in which nothing can be done is by definition short; the window in which something could be done and was not is as long as anybody allows it to be. Attacks against known weaknesses on unpatched systems outnumber genuine zero-days by a wide margin, which is why patching discipline matters more than any defence aimed at the unknown.
• Filtering can only buy time here, and only sometimes. Where the HTTP traffic exploiting a weakness has a recognisable shape, a rule can refuse it before it reaches the application, which is virtual patching. That protects against the versions somebody anticipated and not against the ones they did not, and it is a delay rather than a repair.

The honest summary is that no product prevents the category. What preparation does is shorten the period between a fix existing and your systems having it, and make the traffic reaching your application visible enough that something unusual can be noticed at all, which is what operations is about.

An n-day is a vulnerability that has been disclosed and has a fix, counted by how many days have passed since. It is less dramatic and far more common in real attacks, because a published fix also tells attackers where to look, and scanning for systems that still lack it is cheap.

For anyone running a website, that makes the n-day window the larger risk. Shortening it, by knowing what software you run and applying fixes quickly, protects against more attacks than anything aimed at the unknown.

No defence prevents every zero-day, because by definition the fix does not exist yet. What helps is reducing what an unknown flaw can reach and how long it stays useful:

Expose less. Admin panels, old endpoints and unused plugins that are not reachable from outside cannot be attacked from outside. Know what you run. An inventory of software and versions turns a vendor advisory into a quick yes or no. Patch quickly once the fix exists, so a zero-day does not become a long-lived n-day. Filter in front of applications, which stops exploits that reuse known attack shapes, such as injection, even when the flaw itself is new. Watch for effects, such as unexpected errors, new processes or unusual outbound traffic, which reveal an attack that got through.

Of these, only the last two work before the fix exists, and neither is a guarantee. The others decide how long the exposure lasts.

Blocking exploit traffic while a weakness remains is covered under virtual patching, and the rest of the vocabulary in this glossary.

The layer that reads requests before they reach the application is defined under web application firewall, and a flood that needs no flaw at all under DDoS attack.