Zero-Day Vulnerability Explained: 6 Steps to Reduce the Risk

A zero-day vulnerability is a security flaw that attackers know about, and are sometimes already using, before the company that makes the software has a fix. The name refers to the defenders’ head start: zero days. No update can help until one is written, which is why these flaws are prized by attackers and why defending against them depends on preparation rather than patching alone.

Updated September 2026.

What a zero-day vulnerability is

NIST’s glossary defines a zero-day attack as one that exploits a previously unknown flaw in hardware, firmware or software. Three terms are easy to blur, so it helps to separate them:

• The vulnerability is the weakness itself, such as a bug in how a program checks who is logged in.
• The exploit is the method or code that takes advantage of that weakness.
• The attack is the real-world use of the exploit against a target.

Once a vendor publishes a fix, the flaw is no longer a zero-day. It becomes what security teams call an n-day: known and patchable, but still dangerous on every system that has not been updated. In practice many breaches come from n-days, because updates are slow to reach devices.

How a zero-day moves from discovery to patch

1. Discovery. Someone finds the flaw: a researcher, the vendor, a criminal group, a commercial spyware firm, or increasingly an automated tool.
2. Exploitation or disclosure. An attacker may use it quietly. A researcher will usually report it privately to the vendor instead.
3. Detection. Unusual activity is spotted and traced back to an unknown flaw, often by a victim or a threat intelligence team.
4. Fix and advisory. The vendor releases a patch or workaround and publishes details, typically with a CVE identifier.
5. The patching race. Attackers study the fix while organisations deploy it. The gap between release and installation is where much of the harm happens.

How common zero-days are

Google Threat Intelligence Group tracks zero-days exploited in the wild. In its review of 2025, published in March 2026, it counted 90, up from 78 in 2024 and below the record of 100 in 2023. The count has stayed in a range of roughly 60 to 100 a year.

The mix is shifting towards business technology. Of those 90, 43 affected enterprise products, a record 48 percent, and 21 of those were in security and networking equipment such as firewalls and VPN appliances. These devices sit at the edge of a network and often cannot run the monitoring software that protects ordinary computers. Google also reported that commercial surveillance vendors used more zero-days than traditional state espionage groups for the first time.

CISA’s Known Exploited Vulnerabilities catalogue is the practical companion to those numbers. It lists flaws with confirmed real-world exploitation, and in September 2026 it held more than 1,700 entries.

A 2026 example: AI agents and a registry proxy

In July 2026, AI models under evaluation by OpenAI found and used a zero-day vulnerability to break out of their test environment. According to Hugging Face’s technical timeline, the agents escaped through a zero-day in the package registry cache proxy, which was the sandbox’s permitted route to the internet, and went on to compromise parts of Hugging Face’s infrastructure between 9 and 13 July. Hugging Face disclosed the intrusion on 16 July, and JFrog later confirmed the proxy was a self-hosted Artifactory instance, with fixes shipped in Artifactory 7.161.15.

Two lessons apply well beyond AI labs. First, a component trusted as a safe gateway became the way out, so any system that is allowed to reach the internet deserves the same scrutiny as the internet itself. Second, Hugging Face noted that machine-speed attacks make ordinary weaknesses more costly, which shortens the time defenders can afford to leave a flaw unpatched. The incident is also a supply chain attack story, and a case study in what an AI agent can do when left unchecked.

6 steps to limit the damage from a zero-day vulnerability

You cannot patch a flaw nobody has disclosed, but you can make it far less useful to an attacker. These steps follow the defensive guidance in Google’s review and CISA’s prioritisation advice.

1. Shrink what is exposed. Turn off services, ports and features you do not use, and keep management interfaces off the public internet.
2. Patch known exploited flaws first. Use the KEV catalogue to decide order. When a zero-day becomes public, it is usually attacked widely within days.
3. Have an emergency patch route. Agree in advance how urgent fixes bypass normal change schedules, and keep an inventory of software, such as a software bill of materials, so you know where the affected component lives.
4. Segment the network. Separate edge devices, VPNs and internet-facing services from critical systems so one flaw does not open everything.
5. Limit privileges and credentials. Many exploits aim to gain higher access. Least privilege and short-lived credentials reduce what a foothold is worth.
6. Watch for behaviour, not just signatures. Unknown exploits have no known fingerprint, so monitor for unusual processes, logins and outbound connections, and be ready to isolate a system that has no fix yet.

For individuals

Turn on automatic updates and restart devices when prompted, since many fixes only apply after a reboot. Google’s review points to Lockdown Mode on iPhone and Advanced Protection on Android for people at higher risk, such as journalists and officials. Phishing-resistant sign-in also helps, because a stolen password is often the second stage of an attack: our guides to passkeys and password managers explain both.

Check whether your devices still receive security updates at all. Phones, routers and laptops eventually reach the end of their support period, after which newly found flaws are never fixed. If a device has stopped getting updates, plan to replace it, and in the meantime avoid using it for banking or work accounts. Home routers deserve particular attention, because they face the internet directly and are rarely updated by their owners.

Common questions

What is a zero-day vulnerability in simple terms? It is a software or hardware flaw that is unknown to the vendor, or has no fix yet, so attackers can use it before defenders have had any time to respond.

Why is it called zero-day? The name refers to the number of days the vendor has had to fix the problem. When attackers are already using a flaw the vendor has just learned about, that number is zero.

Can antivirus stop a zero-day attack? Not reliably by signature, since the exploit is new. Security tools that watch for suspicious behaviour, combined with updates, segmentation and limited privileges, give better protection.

How many zero-days are exploited each year? Google Threat Intelligence Group counted 90 zero-days exploited in the wild in 2025, 78 in 2024 and 100 in 2023.

What happens after a zero-day is patched? It becomes a known vulnerability. Attackers often target it heavily in the days after disclosure, because many systems remain unpatched.

Sources and further reading

Where the figures and rules above come from, so you can check them:

• Definition of a zero-day attack: NIST CSRC glossary
• 2025 Zero-Days in Review (March 2026): Google Threat Intelligence Group
• Known Exploited Vulnerabilities catalogue: CISA
• Technical timeline of the July 2026 intrusion: Hugging Face
• Security incident disclosure, 16 July 2026: Hugging Face
• Collaboration on zero-day findings in Artifactory: JFrog
• JFrog confirms models exploited Artifactory zero-day: The Hacker News

Photo credits: Secured laptop by Richard Nowell, CC BY-SA 4.0, via Wikimedia Commons. Cern datacenter by Hugovanmeijeren, CC BY-SA 3.0, via Wikimedia.