Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

What is a zero-day vulnerability? Meaning and risk

In one sentence: A zero-day is a flaw in software that attackers use before the maker has a fix, so there is no patch to install yet.

What it is

The NCSC describes zero-days as weaknesses that were recently discovered and where a fix or patch was not immediately available from the vendor. The name means defenders had zero days to prepare.

The flaw is the vulnerability. The exploit is the method that uses it. The attack is the exploit used on a target. Once the vendor releases a patch the flaw is no longer a zero-day, but it stays dangerous until you install the update.

How it works

  1. Someone finds a flaw nobody has fixed: a researcher, a criminal group or a state.
  2. An attacker builds an exploit and uses it quietly against chosen targets.
  3. The attack is noticed, or the flaw is reported, and the vendor is told. In the MOVEit case, Progress published an advisory on 31 May 2023, after exploitation began on 27 May.
  4. The vendor releases a patch or workaround, and may be forced to do so urgently.
  5. Public details lead to a rush of copy attacks against anyone who has not patched. CISA’s KEV catalogue then tracks flaws with evidence of exploitation.
  6. Customers must apply the update quickly. The NCSC stresses having a process to install vendor updates at pace.

Who it affects and how badly

Organisations running internet-facing software: file transfer tools, VPNs, firewalls, email servers and web platforms. The NCSC says the majority of the top 15 routinely exploited vulnerabilities of 2023 were first exploited as zero-days, and that this trend continued into 2024.

Small firms depend on their vendors and MSP to patch quickly. Mid-sized firms and manufacturers face downtime if an edge device is taken over. Councils, care providers and schools with limited IT staff are slow to patch. Regulated firms, such as fintech and insurers, face data theft, regulator fines and lost clients if a supplier’s product is the way in.

Real examples

MOVEit Transfer, May 2023. CISA says the CL0P gang began exploiting a previously unknown SQL injection vulnerability (CVE-2023-34362) in Progress Software’s MOVEit Transfer from 27 May 2023, installing a web shell to steal data from the underlying databases. Based on evidence of active exploitation, CISA added it to the KEV catalogue on 2 June 2023. Sources: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a and https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023

How to detect it

By definition you cannot match a known signature, so watch behaviour.

  • Alert on unusual activity from internet-facing systems: new processes, new files in web folders, unexpected outbound connections and large data transfers.
  • Check logs on edge devices and file transfer tools. Make sure they are collected somewhere central.
  • Follow the vendor advisories for software you run, and follow the NCSC and CISA alerts.
  • Check your asset list against the KEV catalogue each week.
  • Use endpoint detection and response on servers, and a network monitor on your gateways.

How to fix or prevent it

  1. Keep an asset list so you can answer quickly whether you run an affected product.
  2. Apply emergency vendor patches and workarounds as soon as they are available, and patch anything on the KEV list first.
  3. Reduce exposure. Remove software from the internet that does not need to be there.
  4. Segment the network and use least privilege so one compromised server does not open everything.
  5. Collect logs from internet-facing systems and alert on odd behaviour.
  6. Keep offline backups and a tested response plan.
  7. Choose suppliers with secure-by-design products. The NCSC urges buyers to insist on them.

Related terms

Browse all entries in the vulnerabilities hub.

FAQ

Why is it called zero-day? Because defenders have had zero days to prepare before the flaw is used.

Can a patch stop a zero-day? Not at first. Once a patch exists the flaw is no longer a zero-day, but you must install it quickly.

Is it common? The NCSC says the majority of the top 15 most exploited flaws of 2023 were first exploited as zero-days.

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan at wolfcore.co.uk/free-web-vulnerability-scan and see Wolfcore penetration testing.