What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A zero-day vulnerability is a software or system weakness that attackers know about while the vendor has no patch available. It may be found by a security researcher, the product’s own team, or an attacker; “zero-day” describes the attacker’s knowledge and the lack of a fix, not who discovered the flaw. From discovery to repair, the process may involve private reporting, exploitation, vendor assessment, a patch or mitigation, deployment, and eventual public disclosure.
What “zero-day” means—and what it does not
Google Project Zero defines a zero-day as “a vulnerability that attackers know about, and there is no patch available from the vendor.” The term is about a particular state of a flaw. It does not mean that the flaw was discovered on the day it was exploited, that attackers necessarily found it first, or that a public report already exists.
As an Amazon Associate I earn from qualifying purchases.
- Vulnerability: the underlying weakness in software, hardware, or a service.
- Exploit: a technique or code that takes advantage of a vulnerability.
- Patch: a vendor’s correction for the weakness. A mitigation may instead reduce exposure or risk without fully correcting it.
These events can happen at different times. A vendor may provide a patch before technical details become public, or attackers may exploit a flaw before defenders know it exists. A public disclosure is not itself a patch, and a patch being available does not prove that every affected system has received it.
Free tools Windows power users keep installed
One-click scans. No signup required.
How a zero-day vulnerability is discovered
There is no single discovery route. A security researcher may identify behavior that appears to be a flaw and report it; a software vendor may find a problem while working on its own products; or an attacker may discover and use a weakness without first telling the vendor. Project Zero says its research covers widely used software, including mobile operating systems, browsers, and open-source libraries.
#1 Best Overall
Discovery alone does not establish that a weakness can be exploited, which products or versions are affected, or how serious the risk is. Those questions require assessment by the vendor or project responsible for the affected product. The available evidence does not establish a single universal technical method by which zero-days are found, so discovery should not be reduced to one tool or technique.
What happens after a vulnerability is reported
A researcher or other reporter can send a technical description privately to the affected vendor or project. The recipient needs to assess the report, determine which products and versions are affected, and decide what correction or risk-reduction measure is appropriate. NIST Special Publication 800-216 recommends a formal process for accepting, assessing, and managing vulnerability reports, as well as communicating mitigations or remediation.
NIST SP 800-216, published May 24, 2023, is guidance for federal systems: it covers software, hardware, and digital services under federal control. It recommends an organized handling and communication framework; it does not set a universal number of days in which every vendor must issue a fix.
How attackers exploit a zero-day
If attackers know about a vulnerability and a vendor patch is not available, they may try to use the weakness before defenders can install a correction. Such activity can occur before public disclosure, which is one reason a flaw may be urgent even when users cannot yet download a patch. This article does not provide exploit instructions; the practical defensive point is to follow credible vendor and government alerts and reduce exposure using the mitigations available for the affected product.
Rank #3
In a 2024 advisory about activity in 2023, CISA, the FBI, and the NSA reported that malicious cyber actors exploited more zero-day vulnerabilities to compromise enterprise networks in 2023 than in 2022. The agencies also said that a majority of the advisory’s most frequently exploited vulnerabilities were initially exploited as zero-days in 2023, compared with less than half in 2022. These findings concern the advisory’s defined activity and vulnerability set, not all attacks or later years.
How vendors patch a zero-day—and why deployment matters
After assessing a report or discovering a flaw internally, a vendor works toward a patch or mitigation and communicates what users should do. The specific engineering and release sequence varies by product and is not established as one universal process. For defenders, the important distinction is between a fix being released and the fix reaching every affected system: organizations and users still need to identify affected products, apply available updates, and confirm that deployment succeeded.
When a complete patch is not yet available, a vendor may issue a mitigation that reduces risk. A mitigation is not necessarily equivalent to a permanent correction, so users should follow the vendor’s instructions and apply the eventual patch when it becomes available. For organizations deciding what to address first, CISA describes its Known Exploited Vulnerabilities (KEV) Catalog as an authoritative source of vulnerabilities exploited in the wild and says organizations should use it as an input to vulnerability-management prioritization. KEV is an input, not a complete inventory of every vulnerability or proof that a particular organization is affected.
How coordinated disclosure timelines work
Disclosure policies set expectations for how a researcher and vendor handle a report and when details may become public. They differ by organization; Project Zero’s published deadlines are one example, not an industry-wide rule. Its policy describes these timelines:
Best Value
| Situation | Project Zero policy described |
|---|---|
| Ordinary report | The vendor has 90 days after notification to make a patch available. |
| Patch issued within the 90-day period | Project Zero generally publishes technical details 30 days after the patch is available to users. |
| No patch by day 90 | Project Zero publishes details at the deadline. |
| Vendor commits to a near-term fix | A 14-day grace period may apply. |
| Project Zero finds active exploitation against real users | The policy uses a 7-day deadline instead of 90 days. The 30-day post-patch window still applies when the patch meets that deadline. |
These periods describe Project Zero’s policy, not a legal requirement or a deadline binding on every researcher and vendor. NIST’s federal framework is different in kind: it recommends formal report handling and communication, while a fixed-day deadline is not stated in SP 800-216.
In a policy trial announced in July 2025, Project Zero also described sharing limited report metadata publicly within approximately one week: the recipient, affected product, report date, and deadline. It said it would withhold technical details, or information it believed could materially assist discovery, until the deadline. That was Project Zero’s announced trial, not a general disclosure standard.
What Project Zero’s tracked figures show
As of July 29, 2025, Google Project Zero reported 2,131 vulnerabilities in “New” or “Fixed” status under its 90-day deadline. It also reported that 95 vulnerabilities had been disclosed without a patch being made available to users and calculated a 95.5% lifetime under-deadline fix rate. Those figures describe Project Zero’s own tracked issue population; they should not be treated as representative rates for the software industry as a whole.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchQuick Recap
What to do when a zero-day may affect you
- Check whether your product is affected. Use the product vendor’s advisory to identify affected versions and the recommended response.
- Apply the vendor’s patch or mitigation. If a patch is not available, follow any mitigation guidance the vendor provides rather than assuming that public discussion is a fix.
- For an organization, prioritize known exploitation. Use CISA KEV as one input alongside your own asset inventory and exposure assessment; catalog inclusion alone does not establish that your systems are affected.
- Confirm deployment. Verify that the update reached the relevant devices and services rather than treating its release as proof that remediation is complete.
- Watch for updated guidance. Vendor advice can change as impact assessment and remediation progress.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
