Zero-day
Also: 0-day · Zero-day vulnerability
A flaw already being exploited while no fix exists, so the defender's first information about it is usually an attack rather than an advisory.
The word names a timing relationship, not a severity. A vulnerability is a zero-day for as long as the people who could repair it have had zero days in which to do so: attackers are using it and no patch is available. The moment a fix ships the same flaw becomes an n-day, and the question changes from whether a defence was possible to whether it was applied.
Why the dates matter more than the score
The useful question is not how severe a zero-day is but how long it was in use before anyone knew. BeyondTrust's Remote Support authentication bypass, CVE-2026-102764, was exploited from late August and patched for SaaS customers on 8 October. Mandiant's instruction followed from the gap rather than from the rating: any appliance reachable from the internet on a vulnerable version during that window should be treated as potentially compromised until reviewed.
The same pattern recurs where a fix is still pending. Fortinet's FortiMail file-write flaw was rated 9.8 and under active exploitation while patches were unavailable, leaving workarounds as the only response, and Kiteworks told customers to switch the product off for six hours.
What it is not
A zero-day is not simply an unpatched flaw. Most intrusions use vulnerabilities whose patches have been available for months. The distinguishing property is that no fix existed at the time of use, which removes patching from the list of things the defender could have done.
Questions
- What does zero-day mean?
- It means no fix existed while the flaw was being exploited — the people who could repair it had zero days' notice. Once a patch ships the same flaw is called an n-day, and the question becomes whether the patch was applied rather than whether a defence was possible.
- Does patching a zero-day end the incident?
- Not by itself. A patch closes the way in; it does not remove access already established. After the BeyondTrust bypass, Mandiant advised treating any internet-reachable appliance that ran a vulnerable version during the exploitation window as potentially compromised until reviewed.