A zero-day exploit is the code or technique that takes advantage of a software flaw the vendor does not know about. Since the vendor is unaware of it, no patch exists yet to fix it. The name comes from the fact that, when the first attack happens, the vendor has had “zero days” to prepare a fix — the attacker gets there first. The exploit itself is a tool: it turns a theoretical weakness into a real way to take control of a system, steal data, or run malicious code.
How do a zero-day vulnerability, exploit, and attack differ?
These three terms are easy to confuse, but they describe different things:
- Zero-day vulnerability — the flaw itself in software, hardware, or firmware (the built-in software of a device), unknown to whoever would fix it. Without an exploit it is only a possibility.
- Zero-day exploit — the specific code or technique that triggers the flaw to gain access or run its own code.
- Zero-day attack — using the exploit against a target: delivering a payload, taking over a system, stealing data, or installing malware.
Put simply: the vulnerability is an open door, the exploit is the lock pick, and the attack is the break-in itself.
How does a zero-day differ from an N-day vulnerability?
Once a flaw is disclosed and a patch appears, it is no longer a zero-day. It becomes an N-day — a known flaw with a fix available, but still dangerous wherever the update has not been applied. In practice, N-days are behind most successful breaches, not fresh zero-days. The reason is simple: getting a fix onto every system after disclosure often takes weeks or months, and during that time the flaw is already public. The vulnerability lifecycle also talks about a flaw being “alive” (not yet disclosed), “dead” (disclosed but unpatched), or “zombie” (fixed in newer releases but still working in older, unsupported ones).
How does a zero-day attack unfold?
The flaw itself is new, but what follows usually looks the same and is well documented. A typical attack runs like this:
- Discovery — someone finds the flaw: a researcher, an APT group (an organized, often state-sponsored attack team), or a criminal.
- Building the exploit — writing code that works reliably and repeatably. This usually takes a few weeks.
- Delivery — most often through phishing (a fake email with a link or attachment), a malicious website, an internet-facing service, or an attack through a trusted supplier.
- Triggering the flaw — running the exploit to execute code or gain higher privileges.
- After the break-in — keeping access, hopping to other machines (known as lateral movement), contacting the server that controls the attack (C2), and stealing data.
This last stage matters most for defense. Even when the way in is completely new, what happens next usually resembles familiar patterns. That gives defenders a chance to catch the attack, even though no one has seen its “signature” before.
What is the window of exposure?
The window of exposure is the time from when a vulnerable version of the software appears to when a deployed patch actually protects a given system. With a zero-day, part of that window passes before anyone even knows the flaw exists — defenders have no way to react. The window does not close when the fix is released, but only once it reaches every vulnerable device. That is why knowing what you have in your network, and how fast you patch, directly decides how big the risk is.
How does the zero-day exploit market work?
Knowledge of an unknown flaw is valuable, so it gets traded. The market usually splits into three parts:
- White market — bug bounty programs and responsible disclosure, where a researcher reports the flaw to the vendor for a reward.
- Gray market — sales to government agencies and brokers, often for intelligence or law enforcement.
- Black market — criminal forums and channels where the exploit reaches attackers and the vendor learns nothing.
The gray and black markets are many times larger than the white one. Remote “zero-click” exploits, which need no action from the victim, fetch the highest prices, and the most sought-after exploit chains reach millions of dollars.
Examples of zero-day attacks
- Stuxnet (2010) — a worm that used four Windows zero-day flaws to damage centrifuges in Iran’s uranium-enrichment program; a textbook example of a state-built cyberweapon.
- Log4Shell / CVE-2021-44228 (2021) — a critical flaw allowing remote code execution (RCE) in the Apache Log4j library. The library is so common in Java applications that the flaw affected hundreds of millions of devices, and at its peak more than a hundred attack attempts per minute were detected.
- MOVEit Transfer (2023) — an SQL injection flaw in a popular file-transfer tool, exploited at scale by the Cl0p ransomware group to steal data from thousands of organizations.
- SolarWinds / SUNBURST (2020) — an attack through a trusted supplier: a poisoned software update reached roughly 18,000 customers.
Why is a zero-day hard to detect?
Classic protection works on signatures — antivirus or IDS/IPS compares what it sees against known attack patterns. Against a zero-day this fails by definition: there is no pattern yet for an unknown attack. Effective detection therefore relies on watching behavior and looking for anomalies. Instead of asking “does this match a known threat,” the system asks “does this deviate from the norm.” It watches the effects of the attack rather than the attack itself.
Typical suspicious behavior includes:
- unusual child processes (e.g. a web server suddenly spawning a system shell);
- unexpected outbound connections to the server controlling the attack (C2);
- deviations from the normal picture of network traffic (the baseline, i.e. what counts as typical);
- signs of hopping between machines and unusual communication between hosts inside the network;
- strange data-exfiltration patterns and API calls not seen before.
For a security team (SOC), the key sources are those that do not depend on knowing the specific flaw. EDR/XDR watches behavior on computers, UEBA learns the typical behavior of users and devices, and NDR together with network traffic monitoring (including NetFlow/IPFIX, metadata analysis, even of encrypted traffic) catches in communication what a single computer might miss. Because post-break-in activity follows known patterns, combining signals from the network and from computers often reveals a zero-day attack — even though the way in was never seen before.
How can the risk of zero-day attacks be reduced?
There is no patch for an unknown flaw, so the whole point is to limit the damage and shorten the window of exposure. This is done in layers (known as defense-in-depth):
- Virtual patching — rules on a web application firewall (WAF), IPS, or gateway that block the attack path before an official fix is released and deployed.
- Network segmentation — splitting the network into smaller parts so that taking over one machine does not open access to everything.
- Least-privilege access — everyone gets access only to what they truly need, which makes a compromised account worth less to an attacker.
- Knowing what you have and keeping an SBOM (Software Bill of Materials, a list of software components) — lets you quickly find where a vulnerable library is used once a flaw comes to light.
- Signature-independent detection — watching behavior on computers and in the network as a layer that works when prevention fails.
- Fast patching after disclosure — the sooner you deploy a fix, the shorter the N-day window during which the flaw is already public.
- A ready incident response plan — a rehearsed procedure limits the scope and duration of an incident.
Learn more
- OWASP Top 10 — Zero-day exploits often target web flaws covered by the OWASP Top 10.
- Data Exfiltration (Wyciek danych) — A zero-day exploit can be used to gain access and steal data without detection.
- Application Layer Attack (L7) — Many zero-day exploits operate at layer 7 by abusing application vulnerabilities.
- ARP Spoofing / Poisoning — ARP spoofing is not a zero-day exploit, but it can support attacks after compromise.
- Supply Chain Attack — A zero-day exploit may be embedded in a supply chain attack to infect many targets.
- API Security — Zero-day exploits can target API flaws to bypass controls or expose data.
- Privilege Escalation — Zero-day exploits may enable privilege escalation by abusing unknown vulnerabilities.
- Incident Response Lifecycle — Zero-day exploits require fast incident response because signatures may not exist yet.
