What is a zero-day vulnerability? Definition, and what the patch desk does next

A zero-day vulnerability is a software, firmware or hardware flaw that attackers exploit before the vendor has a security fix available, often before defenders know the flaw exists. For a patch desk, a zero-day means exposure with nothing to deploy yet, so mitigation, exposure reduction and detection come before patching.

Two definitions in use

NIST's glossary, in a definition drawn from CNSSI 4009-2022, describes a zero-day attack as one that exploits a previously unknown vulnerability. The UK National Cyber Security Centre (NCSC) draws the line at the fix instead: a zero-day exploit targets a flaw with no security fix yet available. The difference matters, because a vendor can know about a flaw and still have no patch.

Daily CISO uses the NCSC sense for operations, because what matters at the desk is whether a fix exists.

How a zero-day shows up in the patch stream

Microsoft's Security Update Guide flags them in two fields. A vulnerability is marked Exploited when it was exploited before the security update shipped, and Publicly Disclosed when it was public before release.

In its October 2026 release notes, Microsoft listed CVE-2026-96951, a Windows Shell security feature bypass, with exploitation detected. CISA added the same CVE to the KEV catalog on 13 October 2026 with a due date of 16 October 2026.

What a patch desk does with it

Before a fix exists, apply the vendor's published mitigation or workaround, cut exposure of the affected service, and hunt for signs of the exploitation already reported. Do not wait for KEV to confirm it. CISA lists a flaw only when there is a clear remediation action, so a widely exploited zero-day can be absent from the catalog until one exists.

Once the fix ships, the flaw becomes an n-day and the work changes from defense to deployment. Patch exposed systems first, record the date the fix became available, and treat any later compromise through that flaw as a patching gap to explain.

Where it appears on Daily CISO

Patch Tuesday lists every exploited and publicly disclosed fix in Microsoft's monthly release. Must-patch shows KEV additions with CISA due dates, and the daily briefing carries the day's exploitation news.

Related terms

N-day vulnerability, Patch Tuesday, Known Exploited Vulnerabilities (KEV) catalog and exploit lag.