What is an n-day vulnerability? Patched flaws attackers still exploit

An n-day vulnerability is a publicly disclosed flaw for which the vendor has already issued a security fix, but which attackers still exploit on systems that have not been updated. Closing the gap between a fix's release and its deployment on every affected system is the core of n-day defense, and it is where a patch desk spends its days.

How official guidance frames it

The UK National Cyber Security Centre (NCSC) defines the transition: a zero-day becomes an n-day once the vendor issues a patch, and exploiting it then relies on finding systems that were never updated. The US National Security Agency (NSA) ties the threat to speed. Its mitigation guidance warns that attackers study patches and build exploits soon after release, and that such n-day exploits can be as damaging as a zero-day.

Old flaws, new exploitation

N-days do not expire. On 8 October 2026 CISA added CVE-2015-3306, a ProFTPD access control flaw, and CVE-2016-3081, an Apache Struts command injection flaw, to the KEV catalog. NVD had published the ProFTPD record on 18 May 2015, so the flaw was 4,161 days old when CISA confirmed it was being exploited.

The same day, the catalog also added an ISC BIND denial of service flaw from 2015, CVE-2015-5477. A KEV listing for a decade-old CVE is a prompt to look for legacy software that nobody tracks any more.

What a patch desk does with it

Treat a vendor fix as the start of a race, not the end of the problem. The NSA's first mitigation is to apply all available updates and automate the process as far as possible, because without rapid patching, attackers can operate inside a defender's patch cycle.

Three habits follow. Patch internet-facing systems first, since n-day exploitation depends on finding hosts that were never updated. Search the inventory whenever an old CVE lands on KEV. And when a product is end of life, removal is the remediation: CISA's KEV guidance tells federal agencies to take products that cannot be updated off their networks.

Where it appears on Daily CISO

Exploit lag measures, for each recent KEV addition, how long the CVE had been public before CISA confirmed exploitation, which makes old n-days easy to spot. Must-patch carries the CISA due dates, and the weekly archive keeps the record back to January 2022.

Related terms

Zero-day vulnerability, exploit lag, Known Exploited Vulnerabilities (KEV) catalog and Patch Tuesday.