Zero Day Exploit: What It Is and How It Works

A zero day exploit is a cyberattack that uses a previously unknown software vulnerability, meaning developers have had zero days to fix it. When you hear about a “zero day,” it refers to a security flaw that the software vendor doesn’t know about yet, leaving users completely unprotected. This article explains how these exploits work, why they are so dangerous, and what you can do to reduce your risk.

Formula

The calculator above estimates the relative risk of a zero day exploit based on two factors: the time since the vulnerability was discovered (t) and the probability that a patch has been released (p). The formula is:

Risk Score = (100 – p) × (1 / (1 + t/30))

• t = days since the vulnerability was first exploited (or discovered), in days.
• p = estimated probability (0-100%) that a patch is already available.

The score ranges from 0 (no risk) to 100 (maximum risk). A higher score means the exploit is more dangerous because either no patch exists or the exploit is recent.

Worked Example

Using the default values: t = 30 days, p = 50%.

1. Calculate the denominator: 1 + (30/30) = 1 + 1 = 2
2. Calculate the patch factor: 100 – 50 = 50
3. Divide: 50 / 2 = 25

The result is a risk score of 25. This means moderate risk: a patch exists but many systems may not have applied it yet.

What Exactly Is a Zero Day?

The term “zero day” comes from the software development world. When a developer learns of a vulnerability, they have “zero days” to fix it before it is exploited. There are three related terms you should know:

• Zero day vulnerability – the flaw itself, unknown to the vendor.
• Zero day exploit – the code or technique that takes advantage of the flaw.
• Zero day attack – the actual use of that exploit against victims.

These are distinct from “n-day” vulnerabilities, which are known to the vendor and have patches available. Hackers often target unpatched systems with n-day exploits, but zero days are far more valuable because no defense exists.

How a Zero Day Exploit Works

The typical lifecycle of a zero day exploit follows a predictable pattern:

1. Discovery – A researcher or attacker finds a flaw in software (e.g., a web browser, operating system, or plugin).
2. Weaponization – The attacker writes code that triggers the flaw, often to execute arbitrary commands or install malware.
3. Delivery – The exploit is delivered via phishing emails, malicious websites, or compromised downloads.
4. Execution – The victim interacts with the malicious content, and the exploit runs.
5. Post-exploitation – The attacker gains a foothold, moves laterally, or exfiltrates data.

A famous real-world example is the 2021 Microsoft Exchange Server attacks, where several zero days were used to access email servers worldwide. Another is the 2017 Equifax breach, which exploited a zero day in Apache Struts. In both cases, the vendor had no patch at the time of the attack.

Why Are Zero Days So Dangerous?

There are three main reasons zero days are particularly threatening:

• No defense – Antivirus software and firewalls rely on known signatures. A zero day has no signature, so traditional defenses miss it.
• High value – Zero days are traded on black markets for tens of thousands to millions of dollars. Governments and cybercriminal groups actively purchase them.
• Long shelf life – If the vulnerability isn’t discovered, the exploit can remain effective for months or years.

For example, the “EternalBlue” exploit (which was stolen from the NSA) was used in the WannaCry ransomware attack in 2017. It targeted a Windows vulnerability that Microsoft had already patched two months earlier – but many systems were still unpatched, showing how even known flaws can be devastating.

How to Protect Yourself

You cannot prevent zero days from existing, but you can reduce your exposure:

• Patch promptly – Apply software updates as soon as they are released. The window between a patch and its exploitation is often just days.
• Use endpoint detection and response (EDR) – Modern EDR tools use behavioral analysis, which can catch suspicious activity even without a signature.
• Enable application whitelisting – Allow only approved programs to run, blocking unknown executables.
• Limit administrative privileges – If an exploit runs, it will have fewer permissions to damage your system.
• Back up critical data – Regular offline backups mitigate the impact of ransomware.
• Use a firewall and network segmentation – This limits lateral movement if one machine is compromised.

For individuals, keeping your operating system and browser updated is the most effective step. For organizations, a layered defense is essential because no single tool catches everything.

Common Misconceptions

There are several myths about zero days that lead to poor decisions:

• “Antivirus will protect me” – Traditional antivirus is signature-based and fails against zero days. It may catch the payload after the fact, but not the exploit itself.
• “Only big companies get targeted” – While high-profile targets are common, zero days are often used in mass attacks (e.g., watering hole attacks on popular websites).
• “Patch everything immediately” – While patching is crucial, some patches break functionality. Test in a staging environment first, but do so quickly.
• “Zero days are always state-sponsored” – Many zero days are sold to criminals, and some are discovered by independent researchers who publish them publicly.

Frequently Asked Questions

How are zero days discovered?

They are found through code review, fuzzing (feeding random data to software), and reverse engineering. Some are discovered by security researchers who report them to vendors; others are found by attackers who keep them secret.

Can a zero day be prevented?

No, because the flaw is unknown. However, you can reduce the impact by using secure coding practices, keeping software updated, and monitoring network traffic for anomalies.

What is a zero day in gaming?

In gaming, “zero day” often refers to a game that is pirated and released on the same day as the official launch. It has nothing to do with security vulnerabilities.

How long does a zero day last?

It varies. Some are discovered within days; others remain hidden for years. The average time between a vulnerability being exploited and a patch being released is often measured in weeks, but can be longer.

Should I report a zero day if I find one?

Yes, responsible disclosure is the best practice. Contact the vendor directly or use a bug bounty platform. This gives the vendor time to fix it before attackers exploit it.

What is the difference between a zero day and a known exploit?

A known exploit targets a vulnerability that the vendor has patched. A zero day targets an unpatched, unknown flaw. Known exploits are easier to defend against because signatures exist.

Conclusion

Zero day exploits are a serious threat because they exploit unknown weaknesses. While you cannot eliminate them entirely, staying informed, patching promptly, and using layered security can significantly reduce your risk. The risk score calculator above gives you a simple way to assess the urgency of a potential zero day based on time and patch availability.

Related

• Political Donations: What They Reveal About You
• Furniture Store vs Online Retailer: Delivery, Returns, Service
• Boot Selection Failed: Required Device Missing?

in t | Time to exploit (days) | days | 30 | 0
in p | Probability of patch before exploit | % | 50 | 0
out risk | Exploit risk score | - | (100 - p) * (1 / (1 + t/30)) | 2