What is an example of a zero-day exploit?

A famous example of a zero-day exploit is Stuxnet, a malicious computer worm discovered in 2010. It targeted specific industrial control systems using multiple zero-day vulnerabilities in Windows, allowing it to silently damage nuclear centrifuges.

Why is it called a zero-day?

It is called a zero-day because the software developer has had exactly 'zero days' to fix the problem. The vulnerability is exploited by attackers before the developer even knows it exists, meaning there is no patch available.

What is the difference between a zero-day vulnerability, exploit, and attack?

A zero-day vulnerability is the undiscovered flaw in the software. A zero-day exploit is the actual code or method written by a hacker to take advantage of that flaw. A zero-day attack is the event where the hacker uses the exploit to compromise a system.

How can you protect against a zero-day attack?

Because no patch exists for a zero-day, you cannot stop the vulnerability itself. Protection requires defense-in-depth: using Next-Generation Antivirus (NGAV) that monitors behavior rather than signatures, network segmentation, and strong access controls.

How much is a zero-day exploit worth?

The value of a zero-day exploit varies wildly based on the target system. Exploits for fully patched Apple iOS or Windows devices can sell for millions of dollars on the dark web or to private intelligence firms.

Is a zero-day exploit a virus?

No, a zero-day exploit is not a virus. An exploit is just a method of breaking into a system. However, once the exploit is successful, the attacker will typically use it to install malware, which could include viruses, ransomware, or spyware.

What Is a Zero Day Exploit and How Does It Work?

Introduction

In the world of cybersecurity, time is the most critical metric. When a software flaw is discovered, a race begins between the developers rushing to write a patch and the hackers rushing to write malicious code. Most of the time, the developers win this race, or at least they tie. But what happens when the hackers find the flaw first? What happens when attackers write code to break into a system using a vulnerability that the software creator doesn’t even know exists?

This terrifying scenario is known as a zero day exploit. It represents the pinnacle of cyber threat capabilities because, by definition, there is no official fix for it. When an attacker deploys a zero-day exploit, traditional security defenses like signature-based antivirus software are entirely blind to it. It is an attack that strikes from the shadows, bypassing locked doors by exploiting architectural weaknesses no one realized were there. Understanding what a zero-day exploit is, how it functions, and why it commands millions of dollars on the cyber black market is essential for grasping the reality of modern, advanced persistent threats.

What Is a Zero Day Exploit?

A zero day exploit is a cyberattack technique that takes advantage of an unknown security vulnerability in a computer application, operating system, or hardware device. The term “zero-day” refers to the fact that the software vendor or device manufacturer has had zero days of notice to patch the flaw before it was actively exploited in the wild.

To fully understand the concept, it helps to distinguish between three closely related terms that are often confused:

Zero-Day Vulnerability: The actual flaw, bug, or oversight in the software code. At this stage, it is just a mistake waiting to be found. If a benign researcher finds it and reports it to the vendor privately, it remains a vulnerability, and the vendor will create a patch.
Zero-Day Exploit: The malicious code, script, or sequence of commands written by a hacker to take advantage of that specific vulnerability. The exploit is the tool used to pick the digital lock.
Zero-Day Attack: The active deployment of the zero-day exploit against a target. This is the event where the attacker uses their specialized tool to break into a network, steal data, or install malware.

Because the vulnerability is unknown to the vendor, there is no patch available when the attack occurs. This gives the attacker a massive, asymmetric advantage. Security systems that rely on recognizing known malware signatures will not flag the exploit because it has never been seen before. This makes zero-day exploits the weapon of choice for nation-state intelligence agencies, advanced persistent threat (APT) groups, and highly sophisticated cybercriminal syndicates.

How a Zero-Day Exploit Works

Developing and launching a zero-day attack is a complex, resource-intensive process. Here is how a zero-day exploit lifecycle typically unfolds in plain English:

Vulnerability Discovery: The process begins with intense research. Highly skilled hackers (or security researchers) spend months reverse-engineering software, analyzing its code, and intentionally feeding it unexpected data to see how it crashes. They are looking for a memory leak, a logic flaw, or an input validation error that the original developers missed.
Exploit Development: Once a vulnerability is found, the hacker must write an exploit. This is often the hardest part. They must carefully craft a payload that triggers the bug in a very specific way, allowing them to bypass the software’s normal operations and force it to execute their own commands. This often involves bypassing modern operating system protections like Address Space Layout Randomization (ASLR).
Weaponization: The exploit itself usually just provides an opening—a way to force a system to listen to the attacker. The hacker must then attach a malicious payload to the exploit. This payload could be a remote access trojan (RAT) to steal files, ransomware to encrypt data, or spyware to monitor communications.
Delivery: The attacker delivers the weaponized exploit to the target. This might be done by tricking the victim into opening a specially crafted PDF document, visiting a compromised website (a drive-by download), or simply sending a malicious packet directly to an exposed web server.
Execution: The victim’s vulnerable software processes the malicious input. The bug is triggered, the exploit runs, and the malicious payload is quietly installed. Because the software vendor is unaware of the vulnerability, no alarms are raised, and the attacker gains silent, persistent access to the system.

The zero-day lifecycle: attackers discover an unknown flaw, write a custom exploit, and deliver a malicious payload before the vendor can release a patch.

Watch this overview to understand why zero-day threats bypass traditional security measures and how they are leveraged by attackers.

Zero-Day Exploit vs Known Exploit

The cyber threat landscape is divided into attacks targeting known vulnerabilities and those targeting zero-days. Understanding the difference highlights why zero-days are so highly prized.

Feature	Zero-Day Exploit	Known Exploit (N-Day)
Vulnerability Status	Unknown to the software vendor; no patch exists.	Known to the vendor; a patch has been publicly released.
Detection Probability	Extremely low. Signature-based antivirus will not recognize it.	Very high. Security tools have signatures, and scanners will flag the missing patch.
Attacker Skill Level	Requires world-class reverse engineering and programming skills to discover and write.	Requires minimal skill. Exploit code is often publicly available (e.g., in Metasploit).
Development Cost	Extremely high. Can take months of research and sell for millions of dollars.	Negligible. Attackers can simply download and use existing exploit scripts.
Primary Target	High-value targets: government agencies, dissidents, major corporations, critical infrastructure.	Targets of opportunity: anyone who has forgotten or neglected to install the latest security updates.

It is worth noting that a zero-day exploit has a very short shelf life. The moment a zero-day attack is discovered by a security firm or the software vendor, the race to issue a patch begins. Once the patch is released, the vulnerability is no longer a “zero-day”—it becomes an “N-day” vulnerability. However, because many organizations are slow to apply patches, attackers will continue to use the newly known exploit for months or years against unpatched systems.

Real-World Use Cases

Zero-day exploits are responsible for some of the most devastating and historically significant cyberattacks on record.

The most famous example is Stuxnet, a malicious computer worm discovered in 2010. Stuxnet was unprecedented because it utilized four separate zero-day exploits targeting the Microsoft Windows operating system. This massive arsenal allowed the worm to spread silently across networks via infected USB drives, bypassing all known security protocols. Its ultimate target was the uranium enrichment infrastructure in Iran. Once it reached the specialized industrial control software running the centrifuges, it altered their speeds to cause physical damage while reporting normal operations to the plant engineers.

Another prominent example involves the Pegasus spyware developed by the NSO Group. This sophisticated surveillance software is frequently deployed against journalists, activists, and politicians using “zero-click” zero-day exploits. In a zero-click attack, the victim does not even need to click a link or open a file. The attacker simply sends a specially crafted message (such as an iMessage or WhatsApp packet) to the victim’s phone. The zero-day exploit triggers silently in the background upon receipt, instantly installing the spyware and granting the attacker full access to the device’s microphone, camera, and encrypted messages.

In late 2021, the Log4Shell vulnerability demonstrated the chaos a zero-day can cause when found in ubiquitous open-source software. The vulnerability existed in Log4j, a tiny logging utility used by millions of Java applications worldwide. Before a patch was widely available, attackers realized they could execute malicious code on remote servers simply by forcing the application to log a specific string of text. The zero-day exploit was so trivial to execute and the vulnerable software was so widespread that the entire global cybersecurity industry spent weeks in a state of emergency trying to identify and patch affected systems.

Common Mistakes to Avoid

The most dangerous mistake an organization can make regarding zero-day exploits is assuming that standard antivirus software will protect them. Traditional antivirus works like a digital wanted poster—it scans files against a database of known bad signatures. Because a zero-day exploit has never been seen before, it has no signature. Relying solely on legacy antivirus guarantees that a zero-day attack will succeed unnoticed.

Another critical mistake is flattening the internal network. If a network has no internal segmentation, a zero-day exploit that compromises a single low-level employee’s laptop provides the attacker with a clear, unobstructed path to the company’s most sensitive databases and domain controllers. While you cannot predict how an attacker will gain initial access via a zero-day, you can severely limit what they can do afterward by isolating different parts of the network from each other.

Finally, organizations often fail to implement the principle of least privilege. If a vulnerable application is running with full administrative rights, any zero-day exploit that compromises that application instantly gains administrative control over the entire machine. Applications and users should only be granted the absolute minimum permissions required to perform their tasks, containing the blast radius if an exploit occurs.

Getting Started

You cannot patch a vulnerability that doesn’t exist yet, which means defending against zero-day exploits requires focusing on behavior and architecture rather than just patching software.

First, replace legacy signature-based antivirus with Endpoint Detection and Response (EDR) or Next-Generation Antivirus (NGAV) solutions. These modern tools use machine learning and behavioral analysis. They do not need to know the signature of the exploit; instead, they monitor what the software is actually doing. If a PDF reader suddenly attempts to open a network connection to an unknown server and execute a powershell script, the EDR system will flag the behavior as anomalous and block it, stopping the zero-day exploit in its tracks.

Second, embrace a Zero Trust architecture and strict network segmentation. Assume that a zero-day exploit will eventually bypass your perimeter defenses. By segmenting your network, you ensure that a compromised web server cannot easily communicate with the financial database. Implement robust internal firewalls and require strong, continuous authentication for every connection between internal services.

Lastly, while you cannot patch a zero-day, you must maintain a rapid patching cadence for everything else. When a zero-day is discovered by the public, the vendor will issue an emergency patch, turning it into a known vulnerability. The time between the patch release and your deployment is your window of maximum vulnerability. By establishing automated, rapid patching processes, you ensure that you are protected the moment the fix becomes available. For a deeper understanding of how attackers leverage known vulnerabilities, read our guide on how brute force attacks work and explore the differences between various cryptographic tools like hardware security modules.