A zero-day vulnerability is a security flaw in software that the developer or vendor doesn’t know about yet. The name comes from the fact that the vendor has had “zero days” to fix the problem before someone starts exploiting it. Once a hacker discovers this kind of flaw, they can use it to break into systems, steal data, or install malware – and there’s no patch available to stop them.
These vulnerabilities exist in everything from operating systems and web browsers to smartphone apps and network hardware. They are valuable to attackers precisely because nobody is defending against them. Security software can’t detect what it doesn’t know exists, and system administrators can’t patch what hasn’t been identified.
As of 2026, zero-day attacks remain one of the most serious threats in cybersecurity. Google’s Threat Analysis Group tracked 97 zero-day vulnerabilities exploited in the wild during 2023 alone, up from 62 the year before. Understanding how these attacks work is the first step toward protecting your devices and data.
Zero-Day Vulnerability vs Zero-Day Exploit vs Zero-Day Attack
People use these three terms interchangeably, but they mean different things. A zero-day vulnerability is the flaw itself – a bug or weakness in the code. A zero-day exploit is the piece of code or technique that a hacker writes to take advantage of that flaw. A zero-day attack is what happens when someone actually uses the exploit against real targets.
Think of it like a lock, a lock pick, and a burglary. The vulnerability is a defective lock on your front door. The exploit is the specific tool someone builds to open that lock. The attack is the actual break-in. The lock has been broken since the day it was installed, but it only becomes a problem when someone figures out how to pick it.
| Term | What It Is | Example |
|---|---|---|
| Zero-Day Vulnerability | A security flaw unknown to the vendor | A buffer overflow bug in a web browser’s rendering engine |
| Zero-Day Exploit | Code written to take advantage of the vulnerability | A script that triggers the buffer overflow to execute malicious code |
| Zero-Day Attack | The use of the exploit against actual targets | A hacker sending crafted web pages to steal login credentials from victims |
How Do Zero-Day Attacks Work
A zero-day attack follows a predictable lifecycle, even though the specifics change with every vulnerability. It starts when someone finds a flaw that nobody else knows about and ends when the vendor finally releases a patch. Everything in between is the danger window.
A developer ships software with an unknown security flaw. This happens constantly – modern software contains millions of lines of code, and it’s impossible to catch every bug before release. The flaw could sit undetected for months or even years.
At some point, someone discovers the flaw. That someone might be a security researcher with good intentions, a government intelligence agency, or a criminal hacker. What happens next depends entirely on who found it and what they want to do with it.
If a criminal or nation-state actor finds it first, they either use it directly or sell it. Zero-day exploits are traded on underground markets and through specialized brokers. Prices range from a few thousand dollars for minor software flaws to over $2 million for a full chain exploit that can remotely compromise an iPhone without user interaction.
The vendor eventually learns about the vulnerability – either through responsible disclosure from a researcher, from their own internal discovery, or after an attack is already underway. They then race to develop, test, and release a patch. Until that patch reaches users’ devices, every system running the affected software remains exposed.
What Is the Timeline of a Zero-Day Attack
| Stage | What Happens | Who Is Involved |
|---|---|---|
| 1. Vulnerability introduced | A bug is accidentally included in a software release | Software developers |
| 2. Vulnerability discovered | Someone identifies the flaw before the vendor does | Hackers, researchers, or intelligence agencies |
| 3. Exploit developed | Code is written to take advantage of the flaw | Attacker or exploit broker |
| 4. Exploit used or sold | The exploit is deployed in attacks or sold on underground markets | Cybercriminals, nation-state actors |
| 5. Vendor learns of the flaw | Disclosure by researcher, detection by security firm, or discovery after attack | Vendor, security researchers, incident responders |
| 6. Patch developed and released | Vendor creates and distributes a fix | Vendor’s security team |
| 7. Users apply the patch | End users and administrators install the update | System administrators, end users |
The gap between stages 3 and 6 is called the “window of vulnerability.” During this period, attackers have a working exploit and there’s no fix available. This window can last days, weeks, or even months depending on how quickly the vendor responds.
Famous Zero-Day Attack Examples
Stuxnet (2010) is probably the most well-known zero-day attack in history. This malware targeted Iran’s nuclear enrichment facility at Natanz and used four separate zero-day vulnerabilities in Windows to spread. It specifically attacked Siemens industrial control systems, causing uranium centrifuges to spin at the wrong speeds and destroy themselves. Stuxnet is widely attributed to the United States and Israel, though neither government has officially confirmed involvement.
Log4Shell (2021) affected Log4j, an open-source Java logging library used in hundreds of thousands of applications worldwide. The vulnerability allowed attackers to execute arbitrary code on servers simply by sending a specially crafted text string. Because Log4j was embedded in software from Apache, Amazon Web Services, Cisco, IBM, and countless other vendors, the blast radius was enormous. CISA called it one of the most serious vulnerabilities ever discovered.
EternalBlue (2017) was a zero-day exploit developed by the NSA that targeted a vulnerability in Microsoft’s SMB protocol. The exploit was stolen and leaked by a group calling themselves the Shadow Brokers. Within weeks, EternalBlue was weaponized in the WannaCry ransomware attack, which hit over 200,000 computers across 150 countries. Hospitals in the UK’s National Health Service were forced to cancel surgeries and divert ambulances.
Pegasus (2016-present) is spyware developed by the Israeli company NSO Group. It uses chains of zero-day exploits to remotely compromise iPhones and Android phones without any interaction from the target – no clicked link, no opened attachment. The phone is silently taken over, giving the attacker access to messages, emails, the camera, and the microphone. Pegasus has been found on the phones of journalists, activists, and heads of state.
| Attack | Year | Target | Impact |
|---|---|---|---|
| Stuxnet | 2010 | Iran’s nuclear centrifuges | Physically destroyed enrichment equipment using 4 zero-days |
| Log4Shell | 2021 | Log4j (Java logging library) | Affected hundreds of thousands of applications and services worldwide |
| EternalBlue / WannaCry | 2017 | Windows SMB protocol | 200,000+ computers in 150 countries hit by ransomware |
| Pegasus | 2016-present | iOS and Android devices | Silent surveillance of journalists, activists, and government officials |
| SolarWinds (SUNBURST) | 2020 | SolarWinds Orion software | Compromised 18,000+ organizations including US government agencies |
| Kaseya VSA | 2021 | Kaseya remote management tool | Ransomware spread to 1,500 businesses through supply chain attack |
Who Discovers Zero-Day Vulnerabilities
Security researchers and ethical hackers find zero-days through careful analysis of software code, fuzzing (feeding random data into programs to see what breaks), and reverse engineering. When they find a flaw, they typically report it to the vendor through responsible disclosure channels so it can be patched before attackers find it.
Bug bounty programs pay researchers cash rewards for reporting vulnerabilities. Google, Apple, Microsoft, and hundreds of other companies run these programs. Google’s Vulnerability Reward Program has paid out over $50 million since its launch. Apple offers up to $2 million for a zero-click kernel code execution chain on iPhone. These programs give researchers a financial incentive to report bugs instead of selling them.
Nation-state intelligence agencies like the NSA, GCHQ, and their counterparts in other countries actively hunt for zero-days to use in espionage and military operations. Some governments stockpile zero-day exploits rather than reporting them to vendors, which means the underlying vulnerabilities remain unpatched and can potentially be stolen – as happened with EternalBlue.
Criminal hackers search for zero-days to use in ransomware campaigns, data theft, and financial fraud. They also buy exploits from specialized brokers who operate in gray markets. A working zero-day exploit for a popular platform can sell for hundreds of thousands of dollars.
How to Protect Yourself from Zero-Day Attacks
You can’t prevent a zero-day vulnerability from existing in the first place. But you can reduce your exposure and limit the damage if one is used against you. Here are the practical steps that actually matter.
- Keep all your software updated. Install operating system updates, browser updates, and app updates as soon as they are available. Many zero-day patches arrive as emergency out-of-band updates, and every hour you delay is an hour you remain exposed.
- Enable automatic updates on every device you own. This includes your phone, your computer, your router’s firmware, and any IoT devices on your network. Manual update schedules leave gaps.
- Use reputable security software with behavioral detection. Traditional signature-based antivirus can’t detect zero-day exploits because there’s no signature to match. Modern endpoint protection platforms use behavioral analysis and machine learning to flag suspicious activity even when the specific exploit is unknown.
- Run a properly configured firewall. A firewall won’t stop every zero-day attack, but it limits the network traffic that can reach your devices and makes it harder for an attacker to exfiltrate stolen data.
- Be cautious with email attachments and links. Many zero-day exploits are delivered through phishing emails containing malicious documents or links to compromised websites. Don’t open attachments you weren’t expecting, even from people you know.
- Use the principle of least privilege. Don’t run your day-to-day account with administrator permissions. If malware executes through a zero-day exploit, running as a standard user limits the damage it can do.
- Segment your network. Keep IoT devices, guest devices, and work devices on separate network segments so a compromised device on one segment can’t easily reach everything else on your network.
How Do Companies Handle Zero-Day Vulnerabilities
Responsible disclosure is the standard process for reporting zero-day vulnerabilities. A researcher who finds a flaw contacts the vendor privately and gives them a set period – usually 90 days – to develop and release a patch before the vulnerability is made public. Google’s Project Zero team popularized this 90-day deadline and publishes details after the window closes regardless of whether the vendor has patched.
The CVE system provides a standardized way to track vulnerabilities. CVE stands for Common Vulnerabilities and Exposures, and it’s maintained by the MITRE Corporation with funding from CISA. Each reported vulnerability receives a unique identifier like CVE-2021-44228 (the Log4Shell vulnerability). This system ensures everyone in the security community is talking about the same flaw when they reference a particular CVE number.
Patch Tuesday is Microsoft’s scheduled monthly release of security updates, delivered on the second Tuesday of each month. Adobe, SAP, and several other vendors follow similar schedules. When a zero-day is actively being exploited, vendors often release emergency out-of-band patches outside the regular cycle. These emergency patches signal that the threat is serious enough to break the normal schedule.
Large enterprises also use threat intelligence feeds and intrusion detection systems to identify zero-day exploitation attempts. When a new zero-day is disclosed, security teams prioritize patching based on which systems are most exposed and most critical to operations.
Zero-Day Vulnerability FAQs
Can antivirus detect zero-day attacks?
Traditional signature-based antivirus cannot detect zero-day attacks because there is no known signature to match against. However, modern endpoint protection platforms use behavioral analysis, heuristics, and machine learning to identify suspicious activity patterns. These methods can sometimes catch zero-day exploits by recognizing that a program is behaving abnormally – for example, a PDF reader suddenly trying to execute system commands. No security tool catches every zero-day, but layered protection significantly improves your odds.
How common are zero-day attacks?
They are more common than most people realize. Google’s Threat Analysis Group documented 97 zero-day vulnerabilities exploited in the wild during 2023. Mandiant and other security firms report similar numbers. Most zero-day attacks in 2026 target web browsers, operating systems, and enterprise software. The number of discovered zero-days has been trending upward each year, partly because attackers are more active and partly because the security industry has gotten better at detecting them.
What is a CVE?
CVE stands for Common Vulnerabilities and Exposures. It’s a standardized identification system maintained by the MITRE Corporation, sponsored by CISA (the Cybersecurity and Infrastructure Security Agency). Each publicly known vulnerability gets a unique identifier – for example, CVE-2021-44228 is the Log4Shell vulnerability. Security teams, vendors, and researchers use CVE numbers to make sure everyone is referencing the exact same flaw when discussing or patching vulnerabilities.
How do bug bounties help prevent zero-days?
Bug bounty programs give security researchers a legitimate financial incentive to report vulnerabilities to the vendor rather than selling them on underground markets. When a researcher finds a zero-day, they face a choice: report it to the vendor for a bounty payment, or sell it to exploit brokers for potentially more money. Competitive bounty payouts tip that equation toward responsible disclosure. Apple, Google, and Microsoft all offer substantial rewards – Apple pays up to $2 million for the most critical iPhone vulnerabilities – which channels more discoveries toward patches rather than attacks.
Are zero-days only found in software?
No. Zero-day vulnerabilities also exist in hardware and firmware. CPU vulnerabilities like Spectre and Meltdown (discovered in 2018) affected nearly every modern processor from Intel, AMD, and ARM. Router firmware, IoT device firmware, and even car infotainment systems can contain zero-day flaws. Hardware zero-days are often harder to patch because they may require firmware updates that users rarely install, or in the worst cases, a physical hardware replacement.
Sources
NIST – National Vulnerability Database (NVD) | CISA – Known Exploited Vulnerabilities Catalog
