What is a zero-day vulnerability?
A zero-day vulnerability is a security flaw that attackers know about before the vendor has a fix. So defenders have had "zero days" to patch it (install the fix). A zero-day exploit is the code or trick that takes advantage of the flaw. A zero-day attack is the use of that exploit against real targets.
| Term | Meaning |
|---|---|
| Zero-day vulnerability | A flaw with no patch available, known to attackers or soon to be |
| Zero-day exploit | Working code or a technique that abuses that flaw |
| Zero-day attack | An exploit used in the wild before a fix exists |
| N-day vulnerability | A publicly known flaw with a patch available that has not yet been applied everywhere |
Zero-day vs n-day vulnerabilities
Zero-days get the headlines, but n-days cause more breaches for most organizations. Once a vendor publishes a patch, attackers can compare the old and new code. That shows them exactly what was fixed, so they can build an exploit. Organizations that take weeks or months to patch are exposed to a flaw that is now public.
In practice, the day a patch comes out is the start of a race. Only those who know about a zero-day can use it. Anyone who reads the security notice can use an n-day. Attackers often start scanning the whole internet for unpatched systems soon after.
This matters for priorities. A steady patching routine protects you from far more attacks than worrying about zero-days you cannot see.
The zero-day lifecycle
Most zero-days follow the same path from hidden bug to public fix.
- The flaw is introduced in a software release, often years before anyone finds it.
- Someone discovers it. If a researcher finds it and reports it privately, the vendor can usually fix it before anyone attacks with it. If an attacker finds it, or buys it, the clock starts.
- An exploit is built and used, often quietly against a small number of high-value targets.
- The attacks are spotted by an incident response team, a security vendor or threat researchers.
- The vendor publishes a security notice. It usually has a CVE number (the public ID for the flaw) and short-term workarounds if a patch is not ready.
- A patch is released and the flaw becomes an n-day. Attacks often spread at this point as more groups pick it up.
- It is added to the CISA Known Exploited Vulnerabilities (KEV) catalog, the US government's list of flaws confirmed as used in real attacks.
Why VPNs, firewalls and edge devices are favorite targets
Edge devices are the boxes that connect your network to the internet, such as VPNs (remote access gateways) and firewalls. Many of the most damaging zero-days of recent years hit these devices rather than laptops. Well-known examples:
- The Citrix NetScaler flaw known as Citrix Bleed in 2023
- The Ivanti Connect Secure VPN flaws made public in early 2024
- The MOVEit Transfer file transfer flaw, used in mass attacks in 2023
Google's yearly reviews of exploited zero-days have also reported a growing share aimed at business security and networking products. The reasons are practical:
- They face the internet by design, so attackers can reach them without phishing anyone.
- They sit at the door to the network. A hacked VPN gateway often gives direct access to internal systems and to user passwords.
- They usually cannot run EDR, the software that spots and stops attacks on each computer. So a break-in on the device is hard to see.
- Logging is limited and often not sent anywhere it would be reviewed.
- Patching is slow, because updates need planned downtime and the business relies on the device.
For the flaws being exploited right now, see our roundup of the latest exploited vulnerabilities for November 2026.
How to reduce zero-day risk
You cannot patch a flaw that has no patch. What you can do is cut the number of places an attacker can hit and fix known flaws quickly. You can also spot and contain a break-in early. The table shows how, with a few technical terms: a SIEM is a system that collects logs in one place so alerts can be reviewed.
| Control | What to do | Why it helps |
|---|---|---|
| Attack surface reduction | Inventory internet-facing assets, remove exposed admin interfaces, retire unused services | Fewer targets for both zero-days and n-days |
| KEV-driven patching | Track the CISA KEV catalog and patch listed flaws on internet-facing systems first, within days | Closes the window once a zero-day becomes public |
| Vendor mitigations | Apply published workarounds while waiting for a patch | Reduces exposure during the zero-day window |
| EDR on endpoints and servers | Deploy and monitor endpoint detection and response | Catches what attackers do after the exploit |
| Monitoring and logging | Send firewall, VPN and appliance logs to a SIEM and review alerts 24/7 | Spots unusual logins, new admin accounts and config changes |
| Network segmentation | Limit what VPN users and edge devices can reach, require MFA for admin access internally | Stops one compromised device from becoming a full breach |
What to do when a zero-day hits something you run
When a zero-day is announced in a product you use, work through these steps with your IT team or provider.
- Confirm exposure: which devices run the affected product and version, and do they face the internet?
- Apply the vendor's workaround at once. If the risk is high and there is no workaround, take the device offline.
- Look for signs of a break-in using the vendor's warning signs and any check tools they publish.
- Patch as soon as a fix is available.
- If you find a break-in, treat it as an incident. Change the passwords, keys and certificates stored on or passing through the device.
If you find signs of compromise, contact our incident response team.
How NextGarrison helps
We map and test everything you have that faces the internet. We track flaws attackers are using through our threat intelligence service. And our 24/7 SOC, a team that watches for attacks around the clock, monitors firewalls, VPNs and computers so a new attack is spotted early. See our services.
Need a hand with this?
Talk to a senior consultant. We reply within one business day with clear next steps and a scoped quote.
Written by
NextGarrison Security TeamPenetration testers, SOC analysts and compliance consultants
Our consultants test applications and networks, run 24/7 security monitoring and prepare companies for SOC 2, ISO 27001 and PCI DSS assessments. We write about what we see in real engagements, in plain English.