A zero day vulnerability is a software flaw that the vendor does not know about, or has not yet fixed, so there is no patch when attackers start using it. NIST defines a zero day attack as "an attack that exploits a previously unknown hardware, firmware, or software vulnerability."
Key takeaways
- "Zero day" means the defenders have had zero days to prepare, not that the flaw is new.
- You cannot patch what has no patch, so you reduce exposure and watch for exploitation.
- Once a fix ships, the flaw is no longer a zero day, but it stays dangerous until you apply it.
- CISA's Known Exploited Vulnerabilities catalog tracks flaws attacked in the wild.
What is the difference between a zero day vulnerability, exploit and attack?
The vulnerability is the flaw. The exploit is the code or method that uses it. The attack is the exploit used against a target. People say "zero day" for all three, which causes confusion. The NIST definition is about the attack, and the term covers any previously unknown hardware, firmware or software flaw.
Why is it called zero day?
Because the vendor had zero days to fix it before it was used. The clock starts when attackers act, not when the flaw was introduced. A bug can sit unnoticed in code for years and only becomes a zero day when someone finds and uses it first.
What is the difference between a zero day and a normal CVE?
A CVE is just an identifier for a publicly known vulnerability. Most CVEs are disclosed with a fix and are never exploited widely. A zero day is, by definition, exploited or exploitable before a fix exists. After disclosure it usually receives a CVE number, so the same flaw can be both.
How do I protect myself from a zero day?
You cannot patch it, so you shrink what an attacker can reach and speed up your reaction:
- Keep an inventory. You need to know where a component runs to answer "are we exposed?"
- Reduce exposure. Close unused ports, put admin interfaces behind a VPN, and remove software you do not use.
- Limit what a compromise can do. Use least privilege and separate networks.
- Watch for exploitation. Monitor logs and subscribe to advisories for the products you run.
- Prepare a fast patch path. When a fix or workaround lands, you want hours, not weeks.
- Use exploitation data to prioritize. The CISA KEV catalog lists vulnerabilities exploited in the wild, and it is meant as an input to prioritization. EPSS, from FIRST, estimates the probability that a CVE will be exploited in the next 30 days.
The demo below shows watching for zero days against your own inventory.
Click through it at your own pace, or open it full screen.
For the response side, read how to respond to a critical CVE in a week. You can see a free inventory of your dependencies at gold.safeguard.sh/scan, and the Gold registry shows CVEs with CISA KEV status.
Frequently asked questions
Can a zero day be found by defenders instead of attackers?
Yes. Researchers often find flaws and report them to the vendor. If the vendor fixes it before anyone exploits it, it never becomes an attack.
Is a zero day always severe?
No. Severity depends on what the flaw allows and where the software runs. But a zero day that is being exploited deserves urgent attention.
Does a zero day stop being a zero day after a patch?
Yes, in the strict sense. After a fix exists it is a known, patchable vulnerability, and the risk becomes how fast you apply the patch.
Do zero days affect open source dependencies?
They can. A flaw in a library affects every product that includes it, which is why a current inventory of components matters.
Sources
- NIST CSRC glossary: zero day attack
- CISA Known Exploited Vulnerabilities catalog
- FIRST: Exploit Prediction Scoring System
- Safeguard Gold dependency scan
Last reviewed: 19 October 2026.
