A zero-day exploit is a technique or piece of code that takes advantage of a software vulnerability before an effective security patch is available. It is called “zero-day” because defenders have had zero days to apply a fix when exploitation begins.
A vulnerability is a weakness in software, hardware, or system configuration. An exploit is the method used to take advantage of that weakness, while a zero-day attack is an actual attempt to use the exploit against a target.
| Term | Meaning |
|---|---|
| Zero-day vulnerability | A security weakness for which no effective patch is yet available |
| Zero-day exploit | Code or a technique designed to take advantage of that weakness |
| Zero-day attack | The use of the exploit to compromise a system |
| Security patch | An update intended to correct the vulnerability |
The process usually follows these steps:
- A vulnerability exists in a system but is unknown to the vendor or remains unpatched.
- An attacker discovers the vulnerability and develops an exploit.
- The exploit may allow unauthorized access, data theft, privilege escalation, or malware installation.
- The vendor identifies the weakness and releases a patch.
- Administrators deploy the patch, reducing the opportunity for further exploitation.
Zero-day exploits are especially dangerous because traditional signature-based detection may not recognize them. Defences therefore include behavioural monitoring, intrusion detection and prevention systems, network segmentation, least-privilege access, application allowlisting, regular backups, and rapid patch management. These controls do not necessarily remove the vulnerability, but they can reduce the likelihood or impact of an attack.
A common misconception is that “zero-day” means an attack must occur on the day software is released. It actually refers to the absence of time to patch the vulnerability before exploitation.
For A2.4 Network security, an examiner may ask you to define, explain, or evaluate zero-day exploits. Clearly distinguish the vulnerability, exploit, and attack, then link suitable countermeasures to reduced likelihood or impact.
