Zero day, n-day, CVE, KEV and more, a glossary of mixed up terms

A zero day is an unknown flaw being exploited before a fix exists. A CVE is only an identifier. KEV is a list of flaws seen exploited. EPSS is a probability estimate. These terms answer different questions, and mixing them leads to bad priorities. Here is each one in plain words.

Zero day (zero-day attack)

NIST defines a zero-day attack as an attack that exploits a previously unknown hardware, firmware or software vulnerability. The name reflects that defenders had zero days to prepare. In everyday speech people stretch it to mean any scary new flaw. If a patch exists and the flaw is public, it is better described as a recent or n-day vulnerability.

Question it answers: was anyone able to know about this before the attack?

Zero day vulnerability versus zero day exploit

The vulnerability is the weakness. The exploit is the method of using it. A flaw can be a zero day vulnerability for a while before anyone writes an exploit. Reports often blur the two. When reading, check which one is meant.

N-day

A flaw that is already public, usually with a fix or a mitigation. Most real world compromise comes through flaws like these because organizations are slow to patch. The "n" stands for the number of days since disclosure. Nothing about it is exotic. The gap between publication and your patch is the risk.

Question it answers: how long has this been known?

CVE

A CVE record is an identifier for a publicly disclosed vulnerability, such as a year and a number. It names the flaw so that tools and people can talk about it. It does not tell you that the flaw is exploited, severe in your environment, or fixed. A CVE can exist for a flaw that has no known exploit at all, and a zero day may have no CVE yet.

Question it answers: are we talking about the same flaw?

CVSS

A scoring system for severity of a vulnerability in general. It describes how bad the flaw could be, not whether anyone is using it or whether it is reachable in your software. Many teams over rely on it. Use it as one input.

Question it answers: how severe is the flaw in the abstract?

KEV

The Known Exploited Vulnerabilities catalog is CISA's list of flaws that have been exploited in the wild. CISA says organizations should use it as an input to their vulnerability management prioritization. Entries carry a required action and a due date for federal agencies. A flaw on this list has moved from "could be exploited" to "has been exploited."

Question it answers: has someone been seen using this?

EPSS

FIRST describes the Exploit Prediction Scoring System as an estimate of the probability that a published CVE will be exploited in the wild in the next 30 days. It is a forecast, not a record. A low score does not mean safe, and a high score does not mean you are exposed.

Question it answers: how likely is exploitation soon?

Reachability

Whether the vulnerable code in a library is actually called by your application in a way an attacker can trigger. A library may be present and still harmless in your use. Reachability turns "we have the library" into "this path is open."

Question it answers: can it actually hurt us here?

Exploitability and exposure

Exploitability asks whether a working method exists. Exposure asks whether the vulnerable thing is reachable by an attacker, for instance from the internet. You need both to call something urgent.

Mitigation, workaround and patch

A patch fixes the code. A mitigation reduces risk without fixing it, such as disabling a feature. A workaround is a temporary way to keep working safely. During a zero day, you typically start with mitigations and move to the patch when it lands.

Advisory versus disclosure

An advisory is a notice from a vendor or maintainer about a flaw. Disclosure is the act of making it public. Coordinated disclosure means the reporter and the vendor agree on timing. These words appear together but differ.

SBOM

A software bill of materials lists the components in a piece of software. When a zero day hits, it is how you answer "do we run this?" in minutes.

Where Safeguard fits

Safeguard offers zero day discovery, reachability analysis and compliance evidence automation, which touch several terms above: reachability for the "can it hurt us" question, and discovery for flaws not yet in any catalog.

What to do

1. Use the right word in tickets: zero day only when no patch exists and exploitation is plausible.
2. Rank using KEV, EPSS, reachability and exposure together.
3. Keep SBOMs so you can search for any component.
4. Teach the terms to engineering and leadership once.
5. Reject headlines that mix vulnerability and exploit.
6. Review the glossary in your policy yearly.

Quick check

Sources

1. NIST Glossary, Zero-Day Attack
2. CISA Known Exploited Vulnerabilities Catalog
3. FIRST, Exploit Prediction Scoring System

Last reviewed: 18 October 2026.