What is a zero-day vulnerability?¶
A zero-day vulnerability is a vulnerability not yet publicly known or not yet addressed by an available fix when it is exploited or disclosed.
Avoid the dangerous assumption¶
The dangerous assumption is that a zero-day label proves a sophisticated offender or particular threat group.
It does not.
The term describes the status of knowledge or remediation at a point in time.
A vulnerability may later become publicly documented and patched, but it was still a zero-day when first used.
Investigators should establish:
- when the vulnerability became known
- when the affected system was targeted
- whether a fix or mitigation existed
- whether exploitation is supported by evidence
- what version and configuration were affected.
Do not use “zero-day” simply to mean “unpatched”.
A known vulnerability without an applied patch is different from a previously unknown flaw.
Likewise, an unusual crash or unexplained compromise does not prove a zero-day was involved.
Where a vendor, government body or specialist assesses zero-day exploitation, preserve the source and confidence of that assessment.
The evidential focus remains the same as with any exploitation:
- what request or code reached the system
- what effect followed
- what access was gained
- what records survive.
Attribution should remain cautious. Several groups may obtain or independently discover the same vulnerability.
The label may also change as understanding develops. Record what was known at the relevant time rather than applying a later public classification without explaining the chronology.
Operational takeaway¶
Use “zero-day” only where the vulnerability’s status supports it, and prove the exploitation and resulting access independently of the label.