What is a zero-day vulnerability and why can it be dangerous?

Published on 2026-10-20 by frfrand

Vulnerabilidades zero-day explicadas: descubrimiento, explotación, parches, diferencia con CVE y cómo proteger sistemas sin una corrección disponible.

A zero-day vulnerability is a security flaw that can be exploited before a fix is available or when the manufacturer has not yet had enough time to respond. In common usage, it is used especially for flaws unknown to the vendor or without a patch at the time they are exploited.

The term appears constantly in news and often sounds like a spy movie. But the basic idea is quite simple: there is a security problem and there is still no definitive solution that everyone can install.

Why is it called zero-day?

The expression alludes to the fact that the vendor has "zero days" of preparation or margin to correct the flaw when it is known or begins to be exploited, depending on the use of the term.

It does not mean the error was created yesterday. It may have existed for years within a program without anyone detecting it publicly.

A newly discovered vulnerability does not automatically imply that someone is exploiting it. It is useful to distinguish discovery, exploitation, and availability of a fix.

An everyday example

Imagine a lock used in thousands of buildings. Suddenly a defect is discovered that allows opening it in an unforeseen way.

If there is still no replacement part or definitive procedure to correct it, administrators need temporary measures: limit access, reinforce surveillance, or close certain entrances.

In software something similar happens. There may not yet be an update, but mitigation measures may exist to reduce exposure.

Do all vulnerabilities have a CVE?

Not always. CVE is a public identifier system for certain security flaws. A CVE code helps coordinate information about a problem, affected products, and references.

The existence of a CVE does not mean the flaw is a zero-day nor that it is being actively used by attackers. There are vulnerabilities known for years that still affect unupdated installations.

There are also new problems that do not yet have a public identifier.

What is a mitigation?

A mitigation reduces risk without necessarily correcting the cause of the flaw. It may include disabling a vulnerable function, restricting a service, applying temporary rules, or isolating systems.

For example, if a public application has a vulnerable component and no patch exists, you might be able to disable that component or limit who can access it. The measure depends on the actual flaw and the vendor's recommendations.

It is not advisable to improvise a configuration without understanding the consequences on availability and security.

Why is updating once a year not enough?

Because some vulnerabilities are known and exploited quickly. A program exposed to the Internet and without maintenance can accumulate multiple known flaws, not just zero-days.

Maintaining inventories and knowing which versions are installed allows you to react when an alert appears. If you don't know what applications you run, you can't easily determine whether a warning affects you.

How to prioritize fixes?

Not all vulnerabilities present the same risk. It matters whether the product is installed, whether the affected function is enabled, whether it is accessible from the Internet, and what privileges an attacker could obtain.

It is also worth studying known exploitation and manufacturer recommendations. A severity score is useful information, but it does not replace context.

Can a firewall protect me?

It can reduce exposure to certain attack vectors, but it does not turn a vulnerable service into a secure one. If the affected function needs to be publicly available, a too-general rule may not be sufficient.

The most useful defense usually combines patches when they exist, least privileges, isolation, monitoring, and recovery capability.

What does this mean for a VPS administrator?

If you receive a security alert about a software version you use, verify the source of the alert, the affected versions, and whether there is an official fix or mitigation.

Before applying major changes, prepare a backup and check how to restore the service if something fails. It is also not advisable to leave a critical vulnerability exposed simply because "updating can break something."

And in ArduMaker?

Services executed within a managed VPS at ArduMaker still depend on software with versions and updates. The platform facilitates operations, but it is important to know which packages and applications are used and to review relevant notices.

In short: zero-day describes an especially difficult situation: there is an exploitable flaw and the definitive defense may not be available. Maintaining inventory, reducing exposure, and following official sources helps to respond better.

References: CISA Known Exploited Vulnerabilities Catalog · CVE Program · What is a security audit.