What Is a Zero-Day Vulnerability? Lifecycle, Examples and Defenses

A vendor posts an emergency advisory: a flaw in software you rely on is being exploited right now, and there is no patch yet. Maybe it’s your firewall, your file transfer tool or your browser. What do you do when the usual answer, “install the update”, isn’t available?

That is the zero-day problem. It is the scenario security teams dread because the normal playbook doesn’t work. But “no patch” doesn’t mean “no options”. Most of what protects you from zero-days is work you can do long before one appears.

This guide explains what a zero-day vulnerability is, how its lifecycle plays out, recent trends and the practical steps defenders can take before and after a patch exists.

What a zero-day vulnerability is

A zero-day vulnerability is a security flaw in software or hardware that is unknown to the vendor, or known but not yet fixed, when attackers start using it. The name comes from the number of days the vendor has had to fix it: zero.

A few related terms get mixed up:

• Zero-day vulnerability: the flaw itself.
• Zero-day exploit: the code or technique that takes advantage of the flaw.
• Zero-day attack: the actual use of that exploit against a target.
• N-day vulnerability: a flaw that has a public fix but is still unpatched on many systems. Most real-world breaches use these, not true zero-days.

Zero-days are valuable to attackers because nothing is specifically designed to stop them yet. Security tools may not recognize the exploit, and there is no update to apply.

How common zero-days are

Zero-days are rare compared with ordinary, already-patched flaws, but they aren’t exotic anymore. Google Threat Intelligence Group’s 2025 zero-day review tracked 90 zero-days exploited in the wild in 2025, up from 78 in 2024 and below the 2023 high of 100. Nearly half of the 2025 total, 43, were in enterprise software and appliances, which includes the security and networking gear that businesses put on the internet.

GTIG notes these counts reflect only what it tracked and may change as past incidents come to light. The trend is still clear: edge devices such as VPNs, firewalls and file transfer servers are prime targets because they are exposed to the internet and often sit outside endpoint monitoring.

The lifecycle of a zero-day

Every zero-day moves through roughly the same stages. Knowing them helps you see where you can act.

1. The flaw is introduced. A coding mistake ships in a product. Nobody knows it is there.
2. Someone discovers it. That could be a vendor engineer, a security researcher, a criminal group or a government-backed team.
3. Exploitation or disclosure. If an attacker finds it, they may build an exploit and use it quietly, or sell it. If a researcher finds it, they usually report it privately to the vendor under coordinated disclosure. Google’s Project Zero, for example, gives vendors 90 days to fix a bug, shortened to 7 days when it finds evidence of active exploitation.
4. Detection in the wild. A security team, vendor or researcher spots attacks using the flaw. This is often the moment it becomes a public “zero-day”.
5. Advisory and mitigations. The vendor publishes an advisory, often with temporary workarounds such as disabling a feature or blocking a specific request pattern. A CVE identifier is assigned.
6. Patch release. The vendor ships a fix. The flaw is no longer a zero-day, but the danger isn’t over.
7. Mass exploitation of unpatched systems. Once details are public, many more attackers scan for systems that haven’t been updated. This N-day phase often causes more total damage than the original zero-day.

Key takeaway: You can’t patch a zero-day, but you can make it much harder to reach, limit what an attacker gains from it and catch the activity that follows. The organizations that weather zero-days best are the ones that already had layered defenses in place.

Real-world example: MOVEit Transfer

In 2023, the CL0P ransomware group exploited a previously unknown SQL injection flaw in Progress Software’s MOVEit Transfer, a managed file transfer product. According to a joint CISA and FBI advisory, exploitation began around May 27, 2023. The attackers planted a web shell on internet-facing MOVEit servers and used it to steal data from the underlying databases.

Progress published an advisory on June 1, and CISA added the flaw (CVE-2023-34362) to its Known Exploited Vulnerabilities catalog on June 2. By then, data had already been taken from many organizations, and many more were hit indirectly through vendors that used MOVEit. It is a clear example of a zero-day in an internet-facing product cascading into a supply chain problem.

What defenders can do before a patch exists

These controls work against zero-days precisely because they don’t depend on knowing the specific flaw.

Shrink your attack surface. Every internet-facing service is a potential zero-day target. Take admin interfaces, file transfer tools and remote access portals off the open internet where you can, or put them behind a VPN or zero trust access layer.

Limit privileges. If an exploited app runs with minimal rights, the attacker gets minimal access. Remove local admin rights from everyday users and use separate admin accounts.

Segment your network. A compromised web server shouldn’t be able to reach your accounting system or backups. Segmentation keeps one breach from becoming a company-wide incident.

Use behavior-based detection. Endpoint detection and response (EDR) tools and managed detection services look for suspicious behavior, such as a web server suddenly launching command shells, rather than known malware signatures. That makes them more likely to catch zero-day activity.

Turn on logging and keep it. When a zero-day is disclosed, the first question is “were we hit before we knew?” You can only answer it if logs from firewalls, VPNs, servers and cloud apps exist and go back far enough.

Require MFA everywhere. Many attacks use a zero-day to get a foothold, then steal credentials to spread. Multi-factor authentication slows that second stage.

Keep isolated backups. If a zero-day leads to ransomware, offline or immutable backups are your recovery path. See how to back up business data.

What to do when a zero-day hits your software

1. Confirm exposure. Check whether you run the affected product and version, and whether it is reachable from the internet. An up-to-date asset inventory makes this a 10-minute job instead of a 2-day one.
2. Apply vendor mitigations immediately. Follow the advisory’s workarounds even if they reduce functionality temporarily.
3. Restrict access. If possible, block internet access to the affected system or limit it to known IP addresses until a fix is available.
4. Hunt for compromise. Use the indicators of compromise in vendor and CISA advisories to check logs and systems. Assume you may have been hit before the disclosure.
5. Patch as soon as a fix ships. Prioritize internet-facing systems first.
6. Verify and review. Confirm every instance is patched, then record lessons in your incident response plan.

Use the CISA KEV catalog to prioritize

You can’t patch everything at once, so focus on what attackers actually use. CISA’s Known Exploited Vulnerabilities (KEV) catalog lists flaws with evidence of active exploitation, including former zero-days. Federal civilian agencies are required to fix KEV entries on set timelines, now under Binding Operational Directive 26-04, issued in June 2026, which replaced BOD 22-01. CISA urges every organization to use the catalog to prioritize patching.

For small businesses, a simple rule works: if a vulnerability in something you run appears in the KEV catalog, treat it as urgent. Many security tools and managed service providers can flag KEV matches automatically.

Where to start

• Build or update an inventory of internet-facing systems and the software versions they run.
• Subscribe to security advisories from your key vendors and to CISA alerts.
• Turn on automatic updates wherever they are safe to use, especially browsers and operating systems.
• Deploy EDR or a managed detection service on servers and laptops.
• Check that logs are collected centrally and kept for at least several months.
• Practice a “zero-day drill” once a year: pick a product you use and walk through the 6 response steps above.

For more context on today’s threat landscape, see our overview of cybersecurity trends in 2026.

Conclusion

Zero-days get headlines because they break the usual rule that patching keeps you safe. But the real lesson is that patching was never the only defense. Fewer exposed systems, tighter privileges, segmented networks, behavior-based monitoring and good logs all work whether the flaw is known or not. Build those layers now, and when the next emergency advisory lands, you’ll be checking a list instead of scrambling.

Sources

• Google Threat Intelligence Group: 2025 Zero-Days in Review — 90 zero-days exploited in 2025, 78 in 2024, 100 in 2023; enterprise targeting
• CISA and FBI Advisory AA23-158A: CL0P exploits MOVEit vulnerability — MOVEit zero-day timeline and mitigations
• CISA Known Exploited Vulnerabilities Catalog — authoritative list of actively exploited flaws
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk — current federal remediation directive, replacing BOD 22-01
• Google Project Zero Vulnerability Disclosure Policy — 90-day and 7-day coordinated disclosure deadlines