Key Points
- A zero-day vulnerability is a security flaw that attackers can use before the maker has fixed it; NIST defines a zero-day attack as one that exploits a previously unknown hardware, firmware or software vulnerability.
- Once a flaw is public it usually gets a CVE ID, a common identifier assigned through the CVE Program, which CISA sponsors and MITRE operates.
- CISA’s Known Exploited Vulnerabilities (KEV) catalog lists flaws with reliable evidence of exploitation in the wild and a clear fix, such as a vendor update.
- CISA’s analysis of data back to 2019 found fewer than 4% of CVEs were publicly exploited, but 42% of those were used on the day they were disclosed.
- For everyday users, the best defense is simple: turn on automatic updates, install patches quickly and retire software that no longer gets security fixes.
What is a zero-day vulnerability? It is a security hole in software, firmware or hardware that attackers discover and use before the company that makes the product has released a fix. Because there is no patch yet, even a fully updated device can be exposed, which makes zero-days one of the most urgent problems defenders face.
This explainer covers what the term means, how flaws are tracked and disclosed, how the federal government prioritizes them and what you can do to protect your own devices. It draws on guidance from the Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST).
What does zero-day mean?
NIST’s glossary defines a vulnerability as a weakness in an information system, security procedures, internal controls or implementation that could be exploited or triggered by a threat source. Most vulnerabilities are found by the vendor or by security researchers and are fixed quietly in a routine update.
A zero-day is different because the attacker gets there first. NIST defines a zero-day attack as “an attack that exploits a previously unknown hardware, firmware, or software vulnerability.” The name is commonly explained this way: when attackers start using the flaw, the vendor and its customers have had zero days to prepare a fix or a defense.
Three related terms are easy to mix up:
- Zero-day vulnerability: the flaw itself, unknown to the vendor or not yet patched.
- Zero-day exploit: the code or technique that takes advantage of that flaw.
- Zero-day attack: the real-world use of that exploit against a target.
How a zero-day differs from a known vulnerability
The main difference is timing and whether a fix exists. The table below sums it up.
| Question | Zero-day vulnerability | Known, patched vulnerability |
|---|---|---|
| Does the vendor know about it? | Not at first, or only very recently | Yes, and it has been publicly disclosed |
| Is there a patch? | No, at least not yet | Yes, a vendor update is available |
| Does updating protect you? | Not until a fix ships; temporary mitigations may help | Yes, once the update is installed |
| Main risk for users | Attacks before anyone can patch | Attacks on people who never install the patch |
That last row matters more than many people realize. CISA warns that attackers may target vulnerabilities for months or even years after updates are available. In practice, a large share of damage comes from flaws that stopped being zero-days long ago but were never patched on the victim’s system.
How zero-day attacks work
A zero-day attack usually follows a simple path. Someone finds a flaw, builds a way to exploit it and then uses it against targets before a fix exists. The exploit can arrive through a malicious website, a booby-trapped document or email attachment, or a direct attack on an internet-facing device such as a router, firewall or server.
Once inside, the attacker can do whatever that flaw allows. Some exploits give only limited access or information. Others hand over full control of the affected software, including, in CISA’s description, exploits that reliably reveal login credentials. Attackers can use that foothold to install other malware, steal data or deploy ransomware that locks up files.
Not every flaw is equally dangerous. CISA describes how factors such as a public proof-of-concept, network accessibility, unprivileged access, the skill needed and “wormability” (the ability to spread from machine to machine without user interaction) affect how exploitable a vulnerability is.
How vulnerabilities get tracked: CVE IDs
When a flaw becomes public, it usually gets a CVE ID, short for Common Vulnerabilities and Exposures. CISA describes a CVE ID as a unique, common identifier for a publicly known cybersecurity vulnerability. That shared name lets vendors, security teams and news outlets talk about the same bug without confusion.
According to CISA:
- The CVE Program is sponsored by CISA and run by MITRE through a federally funded research and development center.
- IDs are assigned by CVE Numbering Authorities (CNAs), organizations that can include software vendors, open-source projects, coordination centers, bug bounty services and research groups.
- A CVE record can be Reserved, Published or Rejected. A published record must include an ID, a description and at least one public reference.
- NIST’s National Vulnerability Database (NVD) stays synchronized with the CVE list and adds details such as impact metrics and product names.
How responsible disclosure works
Many flaws are found by researchers rather than criminals. The goal of coordinated vulnerability disclosure is to get a fix ready before details become public, so the vulnerability never becomes a zero-day in attackers’ hands.
CISA runs its own Coordinated Vulnerability Disclosure (CVD) program. A researcher or supplier reports a suspected flaw through CISA’s VINCE-NT platform. CISA triages it, contacts the supplier, analyzes the details, tracks timelines and mediates between the reporter and vendor when needed. It then works with participants on an advisory and a publication date so that vendors, customers and service providers get the information at the same time, which CISA says minimizes the window of exploitation.
Vendors do not get unlimited time. If a vendor is unresponsive or will not set a reasonable timeframe for a fix, CISA says it may disclose a vulnerability as early as 45 days after its first attempt to contact the vendor, whether or not a patch exists.
CISA’s Known Exploited Vulnerabilities catalog
Most disclosed vulnerabilities are never attacked. To help defenders focus, CISA maintains the Known Exploited Vulnerabilities (KEV) catalog, which it calls the authoritative source of vulnerabilities that have been exploited in the wild. A flaw is added only when three conditions are met:
- It has an assigned CVE ID.
- There is reliable evidence it has been actively exploited in the wild.
- There is a clear remediation action, such as a vendor-provided update.
CISA counts both attempted and successful exploitation. Scanning, security research and proof-of-concept code alone do not qualify. For every KEV entry, the instruction is to apply updates per vendor instructions, or to remove the product from the network if it is end-of-life or cannot be updated. Temporary mitigations and workarounds can help until an official patch arrives, but CISA calls the patch the best practice.
CISA created the catalog in 2021 under Binding Operational Directive 22-01, issued Nov. 3, 2021, which required federal civilian agencies to fix listed flaws within two weeks for CVEs assigned since 2021 and within six months for older ones. On June 10, 2026, CISA replaced that directive with BOD 26-04, “Prioritizing Security Updates Based on Risk.” The new directive keeps the KEV criteria and sets urgency based on whether an asset is publicly exposed, whether the flaw is on the KEV list, whether exploitation can be automated and how much control an attacker gains. CISA noted that attackers’ use of AI may further narrow the time defenders have between a patch’s release and possible exploitation.
The directives bind federal agencies, but CISA strongly recommends that every organization, from local governments to private companies, use the KEV catalog to prioritize patching.
Why speed matters
CISA’s analysis of vulnerability data going back to 2019, published with the original directive, found that fewer than 4% of all CVEs had been publicly exploited. But attackers move fast on the ones they choose. Of those exploited flaws, 42% were used on day zero of disclosure, 50% within two days and 75% within 28 days.
That is why security teams treat a newly disclosed, actively exploited flaw as an emergency.
How to protect yourself from zero-day attacks
You cannot patch a flaw that nobody has fixed yet. But you can shrink the window of exposure and limit the damage. CISA’s guidance on patches and software updates and its Secure Our World campaign point to these steps:
- Turn on automatic updates for your operating system, apps and devices, so fixes install as soon as they ship. Look in settings under Software or Security.
- Install all updates, especially for web browsers and antivirus software, and do not keep hitting “Remind me later.”
- Retire end-of-life software. Products that no longer receive security updates stay exposed to every new flaw. CISA recommends retiring all EOL products.
- Get updates only from trusted vendor sites. Attackers send emails with links or attachments posing as legitimate updates that actually contain malware. Learn to spot a phishing message before you click.
- Avoid updating on untrusted networks such as airport, hotel or coffee shop Wi-Fi, unless you connect through a VPN to a trusted network.
- Ask about auto-update. CISA suggests that if a product or device lacks an automatic update option, you ask the provider why not.
Basic account security also limits the damage if a zero-day does hit: strong, unique passwords and multifactor authentication make it harder to turn one compromised device into access to your other accounts.
What organizations should do
For businesses and agencies, CISA’s message is to build the KEV catalog into vulnerability management. That means monitoring the catalog, putting KEV entries first, using automated tools that flag them, applying temporary mitigations when no patch exists and removing systems that cannot be updated. Anyone with evidence of an exploited flaw not yet listed can report it to CISA.
For coverage of major cyberattacks, outages and other top stories as they develop, follow the LiveNewsWorld U.S. News Live center.
The bottom line
A zero-day vulnerability is a flaw attackers can use before a fix exists, and no one can fully prevent them. What you can control is how quickly you close the door once a patch arrives. Turn on automatic updates, install fixes promptly, drop software that is no longer supported and be wary of fake update messages. Those habits will not stop every zero-day, but they protect you from the far larger number of attacks that target flaws already fixed.
Sources
- NIST Computer Security Resource Center, Glossary: zero-day attack; vulnerability
- CISA, Known Exploited Vulnerabilities Catalog and Reducing the Significant Risk of Known Exploited Vulnerabilities (KEV criteria page)
- CISA, BOD 26-04: Prioritizing Security Updates Based on Risk (June 10, 2026) and BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities (Nov. 3, 2021, revoked)
- CISA, The Coordinated Vulnerability Disclosure (CVD) Program
- CISA, Understanding Patches and Software Updates (Feb. 23, 2023) and Secure Our World: Update Software
