A zero-day vulnerability is one being actively exploited before the vendor has released (or sometimes even knows about) a fix — the name refers to the vendor having had "zero days" to prepare a patch.
Why they’re different from regular vulnerabilities
Most vulnerability management (like scanning for known CVEs) can’t catch a zero-day by definition — it isn’t in any database yet. Defense has to rely on broader security hygiene rather than a specific patch.
Practical defenses even without a patch available
- Web application firewalls can sometimes block the exploit pattern generically, even before a formal patch exists
- Least-privilege access limits how much damage a successful exploit can actually do
- Network segmentation contains a compromise to one system rather than the whole environment
- Monitoring for anomalous behavior can catch exploitation even when the vulnerability itself is unknown
Once a patch is released
Zero-days typically get expedited, out-of-cycle patches once discovered — apply these immediately rather than waiting for a routine patch cycle, since active exploitation is often already underway by the time a fix ships.
FAQ
Can vulnerability scanning ever catch a zero-day?
Not directly, since scanners work from known-vulnerability databases — behavioral/anomaly-based monitoring is the closer analog for catching zero-day exploitation in progress.