Cybersecurity teams regularly deal with software vulnerabilities, but zero-day vulnerabilities present a different challenge. These flaws are unknown to the software or hardware vendor when they are discovered or exploited, which means a security patch may not yet exist.
This creates a window in which threat actors may exploit vulnerable systems before organizations have a permanent fix available. Traditional security controls that depend heavily on known signatures can also have difficulty recognizing entirely new attack techniques.
Understanding how zero-day vulnerabilities work can help organizations prepare for this uncertainty. This guide explains what zero-day vulnerabilities are, how they work, how they can be detected, and the steps organizations can take to reduce their impact.
What is a zero-day vulnerability?
A zero-day vulnerability is a security flaw in software, hardware, or firmware that the vendor does not know exists or has not yet released a patch for, giving defenders “zero days” to respond effectively. The term “zero-day” refers to the fact that developers have had zero days to act or address the vulnerability once it becomes known or is actively exploited.
These vulnerabilities can exist in operating systems, web browsers, business applications, mobile devices, firmware, and network appliances. A flaw may remain hidden for months or even years before a security researcher, vendor, or threat actor discovers it.
To understand how zero-day threats unfold, it helps to distinguish between the vulnerability itself, the exploit used against it, the resulting attack, and zero-day malware.
| Term | Meaning |
|---|---|
| Zero-day vulnerability | A previously unknown security flaw |
| Zero-day exploit | Code or a technique created to take advantage of the flaw |
| Zero-day attack | An actual attack carried out using the exploit against a target system or organization |
| Zero-day malware | New or previously unknown malware that security tools may not yet recognize through known signatures or indicators |
In simple terms, the vulnerability is the weakness, the exploit is the method used to take advantage of it, and the attack is the malicious activity that follows.
Zero-day malware and zero-day vulnerabilities are not the same. Zero-day malware refers to new or previously unknown malicious software, while a zero-day vulnerability is an unknown flaw in software, hardware, or firmware. Zero-day malware may exploit such a vulnerability, but it does not have to.
Beyond these distinctions, vulnerabilities can also be categorized based on when they become known and whether a patch is available. This is where zero-day, one-day, and n-day vulnerabilities differ. The table below compares them across key factors:
Key differences between zero-day, n-day & one-day vulnerabilities
| Characteristic | Zero-day vulnerability | N-day vulnerability | One-day vulnerability |
|---|---|---|---|
| Vendor awareness | Unknown to the vendor | Known and previously disclosed | Recently disclosed; defenders begin addressing the vulnerability |
| Patch availability | No patch is available | A patch or mitigation may be available | A patch may or may not be available |
| Detection difficulty | Very high because signatures or indicators may not yet exist | Moderate because defenders have more information about the flaw | High because organizations have a very short response window |
| Attacker opportunity | Attackers can exploit the flaw before defenders know about it | Attackers target systems that remain unpatched after disclosure | Attackers attempt to weaponize the flaw immediately after disclosure |
| Defender priority | Detect suspicious behavior and apply temporary mitigations | Identify affected systems and deploy available patches | Assess exposure and respond rapidly as disclosure and remediation guidance emerge |
A zero-day vulnerability gives vendors and defenders little or no prior opportunity to address a newly discovered flaw, and a patch may not yet be available when it first becomes known. After disclosure, the focus shifts toward mitigation, patching, and remediation.
A one-day vulnerability is an informal term for a recently disclosed flaw during the early response period, when defenders are beginning remediation and attackers may move quickly to exploit it.
An n-day vulnerability is a known vulnerability that has been disclosed for some time and may already have a patch or mitigation available, but can still be exploited on systems that remain unpatched or otherwise exposed.
How zero-day vulnerabilities work?
A zero-day vulnerability can exist in software, hardware, or firmware long before anyone knows it is there. During this period, the vendor may have no patch available, and security teams may not have signatures or indicators that can reliably identify exploitation.
The risk increases when a threat actor discovers the vulnerability before the vendor or security community does. Attackers may develop an exploit and use it against vulnerable systems while defenders are still unaware of the flaw.
Once the vulnerability becomes known, vendors and security teams work to understand its impact, introduce temporary mitigations where possible, release a patch, and remediate affected systems.
Zero-day vulnerability lifecycle
The lifecycle of a zero-day vulnerability typically progresses through the following stages:
Stage 1: Introduction
A coding error, design flaw, or other weakness is introduced during the development of software, hardware, or firmware. At this stage, the vulnerability may exist without being recognized by the vendor or users.
Stage 2: Unknown and undetected
The flaw remains hidden in the affected software, hardware, or firmware. Since it has not yet been identified, there may be no public advisory, CVE, patch, or established detection signature.
Stage 3: Discovery
The vulnerability is discovered by a security researcher, software vendor, threat actor, or automated security testing process. If an attacker finds it first, the discovery may remain private while they investigate how to exploit it.
Stage 4: Exploit development and attack
Threat actors may create code or techniques that take advantage of the vulnerability. If they use that exploit against real-world systems before a fix is available, it becomes a zero-day attack. Depending on the flaw, successful exploitation may enable unauthorized access, remote code execution, privilege escalation, data theft, or other malicious activity.
Stage 5: Disclosure
The vulnerability becomes known to the vendor, either through internal research, responsible disclosure, threat intelligence, or investigation of active exploitation. Public disclosure may follow once the vendor has confirmed the issue and developed guidance for affected users.
Stage 6: Mitigation and patch release
The vendor may first recommend temporary workarounds or configuration changes to reduce exposure. A permanent endpoint security update is then developed, tested, and released to address the underlying vulnerability.
Stage 7: Patch adoption and remediation
Organizations identify affected systems, prioritize critical assets, deploy the available fix, and verify that remediation was successful. Systems that remain unpatched can still be exploited even after the vulnerability is publicly known.
This lifecycle shows why zero-day vulnerabilities are difficult to manage. The greatest uncertainty exists before disclosure, when defenders may not know what flaw is being exploited or how to detect it. Once the vulnerability becomes known, the focus shifts to rapidly identifying affected assets, applying mitigations, and deploying the vendor’s patch as quickly as possible.
Why are zero-day vulnerabilities dangerous?
Zero-day vulnerabilities are particularly challenging because defenders may initially have limited information about both the vulnerability and the techniques attackers are using to exploit it.
A patch may not yet exist, preventing organizations from immediately removing the underlying flaw. Security products that rely primarily on signatures for known threats may also fail to recognize a new exploit.
If the affected software is widely deployed, the potential attack surface can be significant. Successful exploitation may allow attackers to gain unauthorized access, execute malware, escalate privileges, steal sensitive information, disrupt services, or move laterally across networks.
The risk also does not disappear as soon as the vulnerability is disclosed. Once a fix becomes available, organizations still have to identify vulnerable assets and deploy the patch before attackers can exploit systems that remain unpatched.
Real-world examples of zero-day vulnerabilities
Recent zero-day incidents show how quickly attackers can exploit previously unknown flaws before organizations have had time to apply a fix.
Google Chrome: CVE-2026-85046
In September 2026, Google patched CVE-2026-85046, a high-severity type confusion vulnerability in Chrome’s V8 JavaScript engine.[1] Google confirmed that an exploit for the vulnerability existed in the wild when the update was released.
The incident highlights how zero-day vulnerabilities in web browsers can be exploited before users have sufficient time to apply a vendor-provided fix. Organizations need a process for identifying affected browser versions and deploying security updates quickly once a vendor fix becomes available.
F5 BIG-IP APM: CVE-2026-94127
Also in September 2026, F5 disclosed CVE-2026-94127, a critical vulnerability affecting certain BIG-IP Access Policy Manager configurations. F5 confirmed that the vulnerability had been exploited. Successful exploitation could allow an unauthenticated attacker to execute remote code on an affected system.
Adobe Commerce: CVE-2026-75650
In September 2026, Adobe disclosed CVE-2026-75650, a critical zero-day vulnerability affecting Adobe Commerce and Magento Open Source.[3] The flaw could allow an unauthenticated attacker to execute arbitrary code on an affected installation. Adobe confirmed that the vulnerability was being exploited in the wild and released an urgent hotfix, advising affected customers to apply it as soon as possible.
These examples illustrate a common zero-day pattern: a vulnerability is exploited before defenders have a complete understanding of the flaw, followed by rapid disclosure, mitigation guidance, and patch deployment once the issue becomes known.
How are zero-day vulnerabilities discovered and attacks detected?
Discovering a zero-day vulnerability and detecting a zero-day attack are related, but they are not the same.
Vulnerability discovery involves identifying the underlying flaw itself. Security researchers and vendors may use techniques such as code analysis, fuzz testing, penetration testing, vulnerability research, and bug bounty programs to uncover previously unknown weaknesses.
An unknown vulnerability may also first come to light during an incident investigation after attackers have already started exploiting it.
Zero-day attack detection, on the other hand, focuses on identifying suspicious activity caused by exploitation. Since defenders may not have a signature for an unknown exploit, behavioral monitoring becomes particularly important.
Endpoint detection and response tools, network monitoring, anomaly detection, threat intelligence, and security logs can be used by security and IT teams. They can help identify unusual processes, privilege changes, unexpected connections, lateral movement, or other behaviors that warrant investigation. Threat hunting similarly relies on telemetry and anomalous behavior to uncover attacker activity that conventional alerts may miss.
Simply put, zero-day vulnerability discovery finds the flaw, while zero-day attack detection looks for evidence that someone may be exploiting it.
Key distinction: Organizations cannot directly remediate a vulnerability that has not yet been discovered. Zero-day preparedness therefore focuses on reducing exposure, detecting suspicious behavior, limiting attacker privileges, and being ready to deploy mitigations or patches quickly once they become available.
How can organizations mitigate zero-day vulnerability risks?
Zero-day risk management requires a layered security approach that reduces exposure, helps detect suspicious activity, and enables teams to respond quickly when new vulnerabilities emerge.
1. Maintain an accurate asset inventory
Organizations need visibility into the devices, operating systems, applications, and software versions running across their environment. When a new vulnerability is disclosed, an accurate inventory makes it easier to determine which systems may be affected.
2. Keep systems and applications updated
Regular patching cannot eliminate an undiscovered zero-day, but it can remove known weaknesses that attackers may use alongside new exploits. Vulnerability management is a continuous process involving asset discovery, assessment, prioritization, remediation, and verification.
3. Deploy security patches quickly
Once a vendor releases a patch, security and IT teams should identify affected endpoints, prioritize critical systems, test updates where required, and deploy them promptly.
4. Reduce the attack surface
Remove unused applications and services, restrict unnecessary network exposure, and enforce secure configurations. Fewer exposed services give attackers fewer opportunities to gain an initial foothold.
5. Apply least-privilege access
Limit users, applications, and processes to only the permissions they require. This can restrict what attackers are able to do after compromising an endpoint.
6. Monitor for abnormal behavior
Behavioral detection, endpoint monitoring, and network monitoring can help identify suspicious activity even when the specific exploit is not yet known.
7. Prepare an incident response plan
Teams should know how to investigate suspicious devices, apply temporary mitigations, isolate affected systems where necessary, deploy emergency patches, and verify remediation.
How can Scalefusion help mitigate zero-day vulnerability risks?
When a zero-day is disclosed, IT teams need to determine which managed endpoints may be exposed, apply available controls or mitigations, and deploy the vendor’s fix as soon as it becomes available.
Scalefusion UEM and Veltar can support parts of that response workflow through endpoint visibility, update management, compliance enforcement, and endpoint-level security controls.
1. Maintain visibility across managed endpoints
Scalefusion UEM gives IT teams centralized visibility into managed devices, operating systems, applications, and configurations. When a newly disclosed vulnerability affects a particular OS or application, this visibility can help security and IT teams identify which endpoints may require attention.
2. Accelerate patching after a fix becomes available
On supported platforms, Scalefusion provides OS update and application patch management workflows. These workflows help IT teams identify available updates, deploy supported updates centrally, and monitor installation status. Exact capabilities vary by operating system and update type.
3. Enforce continuous endpoint compliance
Veltar can monitor supported endpoints against configured compliance policies and identify deviations. Where remediation is supported and enabled for the relevant rules, it can also attempt automatic remediation of non-compliant settings.
4. Reduce selected endpoint attack paths
Veltar Secure Web Gateway can enforce web access rules at the endpoint, including category, domain, and policy-based filtering. Application Control can allow or block applications on supported macOS devices. Veltar also provides Endpoint DLP and I/O device controls for restricting unauthorized storage device and peripheral use on supported endpoints.
5. Restrict access from non-compliant devices
Scalefusion’s Microsoft Intune Partner Compliance integration can report compliance status for supported Android, iOS, and macOS devices to Microsoft Intune. Microsoft Entra Conditional Access can then use that compliance state when deciding whether users can access configured cloud applications and resources.
These measures can help organizations maintain endpoint visibility, reduce the attack surface, enforce secure configurations, and respond faster once a zero-day vulnerability is disclosed and a vendor fix becomes available.
Strengthen your defense against zero-day vulnerabilities
Zero-day vulnerabilities are difficult to manage because organizations may have little warning, limited detection information, and no immediate patch. Reducing their impact requires a layered approach that combines endpoint visibility, attack surface reduction, behavioral monitoring, secure configurations, and rapid remediation once a fix becomes available.
Scalefusion UEM and Veltar can support this response by helping IT teams maintain visibility across managed endpoints, enforce security and compliance controls, restrict risky access, and accelerate OS and application patch deployment. Together, these capabilities can help organizations shorten the remediation window and strengthen endpoint security as new vulnerabilities emerge.
References:
- Google Chrome: CVE-2026-85046
- F5 BIG-IP APM: CVE-2026-94127
- Adobe Commerce: CVE-2026-75650