A zero day vulnerability is a flaw that defenders do not yet have a public fix for, distinct from any code that later uses it.
Attackers may know the flaw before a vendor publishes a correction, which is why the day of the fix has not arrived.
How it works
The subject of this page is the flaw, not the exploit that triggers it.
No steps for causing the flaw are included.
Inventory tells you whether a disclosure applies to you.
Less exposure, vendor advisories, and a fast path for an out of band update are the defensive response until the flaw is no longer unfixed.
Concrete examples
- A vendor confirms a serious flaw and has not yet published a fix.
- A product you run is affected and no safe configuration workaround is available yet.
- After the fix ships and you install it, the same flaw is no longer a zero day vulnerability.
Protective measures
- Keep an inventory so you can tell whether a new disclosure applies to you.
- Reduce exposure of high value services before any particular flaw is known.
- Subscribe to vendor advisories for the products you actually operate.
- Prepare a fast path to install an out of band fix when one appears.