Zero-day
A security hole that attackers found and used before the software's maker had a fix ready.
"Zero days" is how much warning defenders got: none. Attackers found the flaw first and started using it while the company that makes the software was still unaware, or still writing the fix.
Once the maker releases an update, the flaw stops being a true zero-day. The danger doesn't end there, though. Attackers keep using it against everyone who hasn't installed the update yet, often for months.
People use the term loosely, often for any recently attacked flaw. Patch Sonar's "Zero-day" badge is stricter. It goes only on flaws the vendor itself said were already exploited when it released the fix, or that CISA listed as exploited within 7 days of the flaw going public. Older flaws that attackers pick up later are still on the list as "exploited", just without the badge.
Related terms
- Exploited vulnerabilityA software flaw that attackers are actually using in real attacks, not just one that could be used in theory.
- CISA's Known Exploited Vulnerabilities catalog (KEV)The U.S. government's official list of software flaws with confirmed real-world attacks, each with a deadline for federal agencies to fix it.
- Patch TuesdayThe second Tuesday of every month, when Microsoft and several other vendors release their regular security updates.