Zero-Day Exploits Defined in Plain Terms
A zero-day exploit is an attack that uses a software flaw the vendor does not yet know about or has not yet fixed. The name means the vendor has had zero days to release a patch so there is no official defence available at the moment the attack begins.
That gap is what makes zero-days dangerous. The usual advice is to patch quickly but a zero-day has no patch to apply. Attackers can move through email systems, VPNs, file-transfer tools and other everyday software while defenders are still unaware the hole exists.
The problem is growing. In its Threat Landscape 2025 report, the EU Agency for Cybersecurity (ENISA) found that vulnerability exploitation was behind 21.3% of the intrusions it studied, second only to phishing. ENISA also found that attackers now weaponise newly disclosed flaws within days sometimes within hours.
How a Zero-Day Exploit Works
Every zero-day follows a rough life cycle. Someone finds a flaw in a piece of software. They write exploit code that turns the flaw into a working attack. They use it quietly against targets while the vendor stays unaware. At some point the flaw is discovered or disclosed, the vendor builds a patch and defenders race to apply it.
The dangerous period is the window between first use and a working patch. During that window there is no signature to detect the attack and no update to install. This is why a zero-day can succeed against an organisation that is otherwise well patched and well run.
Three terms often get mixed up. A zero-day vulnerability is the flaw itself. A zero-day exploit is the code or technique that abuses the flaw. A zero-day attack is the act of using that exploit against a real target. The same flaw can sit unnoticed for years before anyone builds an exploit for it.
Finding these flaws has become a business of its own. Legitimate researchers report bugs through vendor bug-bounty programmes. Others sell working exploits on a grey market where a single reliable exploit for a popular platform can fetch hundreds of thousands to several million dollars. ENISA notes that state-backed groups and commercial surveillance vendors are among the heaviest buyers and users.
Disclosure does not end the danger. Once a flaw is public and patched it becomes what defenders call an n-day, and attackers scan the internet for systems that have not updated yet. Many of the largest incidents are actually n-day attacks on organisations that were slow to patch.
Types of Zero-Day Attacks
Zero-days are not a single kind of attack. They show up in different places and the location decides what the attacker can do.
- Remote code execution: The attacker runs their own commands on a server or device across the internet, which is why these flaws are the most prized.
- Privilege escalation: A flaw that turns a low-level foothold into full administrator control, letting an intruder who is already inside take over.
- Authentication bypass: The attacker is treated as a trusted user without logging in, which is how several gateway and VPN flaws have worked.
- SQL injection and other web-application flaws: Malformed input makes a web application hand over its database, as happened with MOVEit Transfer.
- Zero-click compromise: A booby-trapped message or file takes over a device on arrival with no click or action from the target.
The Business Impact of a Zero-Day Attack
A zero-day attack tends to cost more than an ordinary breach for one reason. There is no patch to stop it, so the attacker often has a long head start before anyone notices. That extra time means more data stolen, more systems reached and a harder clean-up.
The damage lands in several ways.
- Data theft and extortion: Attackers copy sensitive files and demand payment to stay quiet, the model Cl0p used against MOVEit customers.
- Operational downtime: Systems are taken offline for containment and rebuilding, which can halt payroll, production or public services for days.
- Supply-chain blast radius: One flaw in a widely used product reaches every organisation that runs it so a single zero-day can hit thousands of firms at once.
- Regulatory and legal exposure: A breach of personal data triggers reporting duties and possible fines under GDPR and NIS2, covered further below.
- Reputation and trust: Customers and partners lose confidence once a breach becomes public and that cost is slow to recover.
The scale of the underlying problem is large. ENISA reports that more than 48,000 new vulnerabilities were catalogued in 2025, a rise of 22 percent on the year before. Only a small share are ever used as zero-days, but any one of them can become the next mass-exploitation event.
Real-World Zero-Day Cases
Zero-days sit behind some of the most serious incidents in modern cybersecurity. Four stand out.
Stuxnet, 2010
Stuxnet was a computer worm built to sabotage Iran’s uranium enrichment programme, and it is the case that put zero-days on the map. Peer-reviewed analyses and a 2010 ICS-CERT advisory record that it chained four separate Windows zero-day flaws, an almost unheard-of feat at the time.
The worm spread on USB drives to cross the air gap around the plant’s control systems, then quietly drove centrifuges to destruction while showing operators normal readings. The Institute for Science and International Security estimated in December 2010 that it damaged roughly 1,000 centrifuges at the Natanz plant.
Stuxnet crossed into an isolated network on a USB stick. Had removable media been locked down and the control network kept fully separate from office systems, the worm would have struggled to spread.
Log4Shell, 2021
Log4Shell was a flaw in Log4j, a tiny open-source logging component built into a huge range of Java applications and products. Tracked as CVE-2021-44228, it let an attacker run code on a server by sending it a single crafted string.
Exploitation was detected from around 1 December 2021, before most organisations knew the flaw existed. CISA issued Emergency Directive 22-02 on 17 December 2021 ordering federal agencies to fix it immediately because the component was so widespread that few could say for certain where they ran it.
The hard part of Log4Shell was not the patch but finding every place Log4j was buried. A current software inventory, or bill of materials, is what lets an organisation locate and fix an embedded component before attackers reach it.
MOVEit Transfer, 2023
In May 2023 the Cl0p ransomware group, also tracked as TA505, began exploiting a previously unknown SQL injection flaw in Progress Software’s MOVEit Transfer, a tool organisations use to move files securely. The flaw is tracked as CVE-2023-34362.
A joint CISA and FBI advisory published on 7 June 2023 describes how Cl0p installed a web shell to steal data from the databases behind MOVEit. The group never needed to encrypt anything. It simply took the data and demanded payment, and the campaign reached thousands of organisations worldwide including banks, airlines and government bodies in Europe.
Because MOVEit sat on the internet and handled bulk data, the defence that counted was tight monitoring of the appliance and its outbound traffic so a sudden mass export of files would raise an alarm even with no patch yet available.
Ivanti Connect Secure, 2024
In January 2024 attackers chained two zero-day flaws in Ivanti Connect Secure, a VPN gateway used to give staff remote access. The flaws, tracked as CVE-2023-46805 and CVE-2024-21887, had been exploited since December 2023.
The attack showed a clear trend. The security and network appliances meant to protect the edge of a network have become prime zero-day targets, a pattern ENISA also highlights for VPN and gateway products. CISA issued Emergency Directive 24-01 on 19 January 2024, its first of the year, and later ordered federal agencies to disconnect affected Ivanti devices because no patch was ready.
With no fix available, the response was to isolate the device itself. An exposed appliance under active attack should be taken offline quickly, checked with the vendor’s integrity tool and watched for known indicators.
Zero-Day Exploits and Compliance
A zero-day is not an excuse in the eyes of a regulator. Swedish and EU rules expect you to manage vulnerabilities, report incidents on time and keep control of the software in your supply chain, whether or not a patch existed.
Sweden’s Cybersäkerhetslagen (SFS 2025:1506) brought the EU NIS2 Directive into national law on 15 January 2026. NIS2 Article 21 requires risk-management measures that cover vulnerability handling and supply-chain security and Article 20 makes the board personally accountable for them.
If a zero-day attack causes a significant incident subject to NIS2 reporting requirements, an early warning must be submitted within 24 hours, followed by an incident notification within 72 hours of becoming aware of the incident. A final report is generally required within one month of the incident notification. Our NIS2 compliance guide sets out the full duties.
Financial entities have a parallel duty under DORA. Article 17 requires structured management of ICT-related incidents, and a zero-day exploited against a bank or insurer is exactly such an incident, supervised in Sweden by Finansinspektionen. DORA also expects regular testing of defences which our DORA compliance guide explains in detail.
If the zero-day exposes personal data, GDPR Article 33 adds a 72-hour duty to notify the Swedish data protection authority, IMY. The MOVEit case is the obvious example, where stolen files held personal records for large numbers of people. See our GDPR compliance guide for how breach notification works.
Standards point the same way. ISO 27001 asks for managed vulnerability handling and timely patching as part of a security management system and regular penetration testing helps find the weaknesses attackers would reach first. Our ISO 27001 guide covers the control set.
How to Spot a Zero-Day Attack
You cannot spot a zero-day by its signature, because there is no signature to match. What you can spot is the behaviour around it. The exploit still has to do something once it lands and that activity often looks wrong.
- Unexpected outbound traffic such as a server suddenly sending large volumes of data to an unfamiliar address.
- A trusted application spawning unusual child processes or running commands it never normally runs.
- New accounts, changed privileges or logins at odd hours on a sensitive system.
- A security or network appliance behaving strangely since these are now common targets.
- Alerts that cluster around one internet-facing system in a short space of time.
Even then, detection is not a guarantee. A skilled attacker moves slowly and blends in and no single alert proves a zero-day. Spotting one usually depends on correlation across many signals and on people who know what normal looks like rather than on any one tool.
How to Defend Against Zero-Day Exploits
You cannot patch a flaw nobody knows about so defence against zero-days is about limiting what an exploit can reach. The goal is to shrink that window and limit how far an exploit can spread.
A few controls do most of the work.
- Patch fast when a fix ships. Treat vendor emergency patches as urgent because the gap between a patch and mass exploitation is now measured in days.
- Segment your network so a foothold in one place cannot reach everything. Keep office systems, servers and any control systems apart.
- Reduce your exposure. Take appliances and services off the public internet where they do not need to be there and remove software you no longer use.
- Keep a live inventory of your hardware and software including the components inside your applications, so you can find an affected product fast.
- Monitor for behaviour, not just signatures. Watch for unusual processes, logins and outbound data on critical systems.
- Have an incident plan that can isolate a device or system quickly, run integrity checks and bring in help when no patch exists.
No single product stops every zero-day. What works is depth, the overlap of patching, segmentation, inventory, monitoring and a tested response plan so that when one layer fails another slows the attacker down. A managed detection and response service adds the round-the-clock watch that catches the behaviour a zero-day leaves behind.
Start by listing what you run and taking anything you do not need off the internet today.
