[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What is a Zero-Day (0-Day)?](/blog/zero-day) Publish date July 8, 2025 {x} minute read # What is a Zero-Day (0-Day)? [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](#) [Free trial](/demo) Written by [Abi Tyas Tunggal](/team/abi-tyas-tunggal) Writer and Senior Product Manager at UpGuard. Abi's work has influenced leaders across cybersecurity, technology, and financial services. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents Free resource ### [Download now](#) A zero-day (0-day) is an unpatched security [vulnerability](https://www.upguard.com/blog/vulnerability) that is unknown to the software, hardware or firmware developer, and the [exploit](https://www.upguard.com/blog/exploit) attackers use to take advantage of the security hole. In general, zero-day refers to two things: 1. **Zero-day vulnerabilities:** A security hole, such as one in an operating system, that is unknown to its developer and antivirus software.  2. **Zero-day exploits: **A [cyber attack](https://www.upguard.com/blog/cyber-attack) that takes advantage of a zero-day vulnerability. Zero-day exploits can be used to install different [types of malware](https://www.upguard.com/blog/types-of-malware), steal [sensitive data](https://www.upguard.com/blog/sensitive-data) or credit card numbers and cause [data breaches](https://www.upguard.com/blog/data-breach).  Zero day gets its name from the number of days that a patch has existed for the flaw: zero.  ## What are The Risks of Zero-Day Vulnerabilities? [Zero-day threats](https://www.upguard.com/blog/cve-2021-26855) represent significant [cybersecurity risk](https://www.upguard.com/blog/cybersecurity-risk) because they are unknown to the party who is responsible for patching the flaw and may already be being exploited. For example, [BlueKeep (CVE-2019-0708)](https://www.upguard.com/blog/bluekeep-rdp-cve-2019-five-reasons-to-be-worried) is a remote code execution flaw that affects approximately one million systems (as of 29 May, 2019) running older versions of Microsoft operating systems.  This zero-day vulnerability made headlines during Microsoft's May 2019 Patch Tuesday due to its wormability. This means successful [cyber attacks](https://www.upguard.com/blog/cyber-attack) using BlueKeep can propagate in a similar way to[ WannaCry's](https://www.upguard.com/blog/wannacry) EternalBlue exploit.  Microsoft saw BlueKeep as such a large [cyber threat](https://www.upguard.com/blog/cyber-threat) to [information security](/blog/information-security) and [cybersecurity](/blog/cyber-security) that they released patches for out-of-support and end-of-life operating systems like Windows 2003 and Windows XP.  BlueKeep is easily discovered with tools like Masscan and Zmap scanning large parts of the Internet in minutes, making it trivial for attackers to find vulnerable systems. [Learn about the MOVEit Transfer Zero Day >](https://www.upguard.com/blog/the-moveit-0-day) ## What Makes a Vulnerability a Zero-Day Vulnerability? Ordinarily security researchers find potential [vulnerabilities](/blog/vulnerability) in [software programs](https://www.upguard.com/blog/how-to-identify-vulnerable-third-party-software), notify the software company to patch the security risk and after a period of time disclose it to the public on [CVE](https://www.upguard.com/blog/cve). For example, Google's Project Zero gives [vendors](https://www.upguard.com/blog/third-party-vendor) up to 90 days to patch a vulnerability before they disclose the flaw. That said, flaws deemed critical are given seven days to patch and actively exploited vulnerabilities may be publicly disclosed right away. This is because most companies given time can fix the vulnerability and distribute a software update (patch) to fix it.  And generally this works. It takes potential attackers time to figure out the best way to exploit the vulnerability. However, there are situations when the discoverer chooses not to notify the software vendor as well as antivirus vendors.  Zero-day vulnerabilities and exploit codes are extremely valuable, not just to cybercriminals, but to nation-state actors who can use them to launch [cyber attacks](/blog/cyber-attack) on enemy states. ## What are Common Zero-Day Attack Vectors? The [attack vector](/blog/attack-vector) used in a zero-day attack will depend on the type of zero-day vulnerability.  Sometimes, when users visit rogue websites, malicious code on the site can exploit zero-day vulnerabilities in web browsers like Internet Explorer or Chrome. Another [common attack vector](https://www.upguard.com/blog/attack-vector) to exploit zero-day vulnerabilities is email. Cybercriminals may use [email spoofing](/blog/email-spoofing), [phishing](/blog/phishing) or [spear phishing](/blog/spear-phishing) to launch attacks that need to be opened by the victim to execute the malicious payload. The danger of zero-day attacks is that their attack vector is unknown and typically undetected by threat intelligence and security software. ## Who are the Typical Targets of Zero-Day Attacks? * Government agencies * Large enterprises * Individuals with access to valuable business data or intellectual property * Groups of individuals with vulnerable systems such as an outdated Android or linux device * Hardware devices and their firmware * Internet of Things (IoT) * Enemies of the state ## What are Examples of Zero-Day Attacks? * [**WannaCry**](https://www.upguard.com/blog/wannacry)**:** A [ransomware](https://www.upguard.com/blog/ransomware) [computer worm](https://www.upguard.com/blog/computer-worm) that exploited EternalBlue, a software vulnerability in legacy versions of Microsoft Windows that used an outdated version of the Server Message Block (SMB) protocol. Security researchers at the National Security Agency (NSA) discovered the security hole months prior to Wannacry but chose not to disclose it to the public. EternalBlue was stolen by cybercriminals and used to create WannaCry which was able to spread to hundreds of thousands of machines before Microsoft could issue a security patch to close the [exploit](https://www.upguard.com/blog/exploit). * **Stuxnet:** A malicious [computer worm](https://www.upguard.com/blog/computer-worm), first uncovered in 2010, thought to have been in development since at least 2005. Stuxnet targeted SCADA systems in Iran's uranium enrichment plant at Natanz and used five zero-day exploits to spread and bypass [access control](https://www.upguard.com/blog/access-control) to systems. Though one of these vulnerabilities had been patched by Microsoft prior to the attack, the machines had not been kept up-to-date.  * **RSA: **In 2011, attackers used an unpatched vulnerability in Adobe Flash Player to breach the [network security](/blog/network-security) of security company RSA. The attackers used [phishing](/blog/phishing) and [email spoofing](/blog/email-spoofing) to spread infected Excel spreadsheets to small groups of RSA employees. The Excel files contained an embedded Flash file that exploited the zero-day vulnerability, installing the Poison Ivy remote administration tool (RAT). Once they gain access, the attackers searched for [sensitive data](/blog/sensitive-data) and transmitted it to their servers.  * **Operation Aurora: **In 2009, attackers believed to be from China gained unauthorized access to dozens of American companies including Google, Adobe, Juniper Networks and Rackspace by exploiting a zero-day vulnerability found in several versions of Internet Explorer.  * **Sony Pictures: **Sony Pictures suffered from a zero-day [malware](https://www.upguard.com/blog/malware) attack in late 2014. The attackers exploited a vulnerability in Server Message Block (SMB) which led to a [massive data breach](https://www.upguard.com/blog/biggest-data-breaches) of valuable corporate data that could be used for [corporate espionage](https://www.upguard.com/blog/corporate-espionage) including forthcoming movies, business plans and personal email addresses of key Sony executives.  Free resource ### [Download now](#) ## Related posts Learn more about the latest issues in cybersecurity. Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) August 25, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 Cybersecurity #### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025) Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command) Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more. [](/team/revashni-moodley) [Revashni Moodley](#) December 1, 2025 Cybersecurity #### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos) Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap. [](/team/phil-ross) [Phil Ross](#) September 3, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)