What Is a Zero-Day Vulnerability?

Zero-day vs n-day

Once a vendor publishes a patch, the flaw is no longer a zero-day. It becomes an n-day vulnerability, and exploitation often rises sharply at that point, because attackers can study the patch to build exploits while many organisations have not yet applied it. In practice, n-day vulnerabilities on unpatched internet-facing systems cause far more incidents than true zero-days.

Why edge devices are targeted

VPN gateways, firewalls, load balancers and managed file transfer servers sit on the internet, hold valuable access and are often hard to monitor. Several of the most damaging campaigns in recent years used zero-days in exactly these products. Knowing which of these devices you expose, and what versions they run, is the first step to responding quickly.

Responding to a zero-day

Identify whether you run the affected product and where it is exposed. An accurate internet-facing asset inventory turns this from days into minutes.
Apply vendor mitigations or restrict access until a patch is available.
Patch as soon as a fix is released, then confirm the fix took effect.
Hunt for signs of compromise, because exploitation may have happened before disclosure.

How DarkInvader helps

DarkInvader shows which of your internet-facing assets run software affected by newly disclosed and actively exploited vulnerabilities, so you know within minutes whether a zero-day touches you and which systems to patch or isolate first.

Explore Vulnerability Scanning

Frequently asked questions

Can you protect against a zero-day before a patch exists?

Partly. You cannot patch, but you can reduce exposure by limiting internet access to management interfaces, applying vendor mitigations, segmenting networks and monitoring for unusual behaviour.

How common are zero-day attacks?

True zero-day exploitation is less common than attacks on known, unpatched vulnerabilities, but it is concentrated on high-value targets and edge devices, where the impact is severe.

Does a zero-day get a CVE?

Usually, once it is disclosed. A CVE identifier is assigned so everyone can refer to the same flaw, and actively exploited ones are often added to the CISA KEV catalogue.