A zero day exploit is code that uses a flaw before a vendor fix exists, and this page names that code without providing any of it.
The flaw itself is the companion topic, while an exploit is the means that makes the flaw do something harmful.
How it works
Defenders may notice the exploit only through effects, such as a crashed service or an unexpected process.
There is no sample here and no procedure for building or running such code.
Reducing who can reach a service limits the callers who could use an unfixed flaw.
When a vendor fix appears, the same code is no longer ahead of the patch, and the management program should confirm the fix landed.
Concrete examples
- Working exploit code circulates in private before any vendor fix is published.
- An intrusion uses a method the vendor later says had no fix on that date.
- A detection watches for the effect of a known case without reproducing the code.
Protective measures
- Reduce how many callers can reach services that would be valuable targets.
- Allow only named administration tools to run on sensitive hosts.
- Preserve logs when you suspect a method that has no vendor fix yet.
- Apply the vendor fix as soon as it exists and verify the exposure is gone.