# Zero-Day

A previously unknown software vulnerability that is exploited by attackers before the vendor has released a fix.

A **zero-day[↗](/zero-day)** is a previously unknown software vulnerability[↗](/vulnerability) that attackers exploit[↗](/exploit) before the vendor is even aware it exists, let alone has released a fix, the name refers to the fact that the vendor has had "zero days" to prepare a patch[↗](/patch). Because no patch exists yet, zero-day vulnerabilities are especially dangerous and often fetch high prices on underground markets.

Zero-day attacks are one of the reasons defense-in-depth matters: even organizations that patch diligently can be caught out by a vulnerability nobody yet knows about, which is why layered defenses like network monitoring, least-privilege access, and rapid incident response[↗](/incident-response) remain essential even in a fully patched environment. Once a zero-day is discovered and a fix is released, it stops being a "zero-day" and simply becomes another vulnerability that unpatched systems remain exposed to.