In more detail
A zero-day is a vulnerability unknown to the software's maker, or without an available fix, that attackers can exploit before anyone can defend against it. The name refers to the vendor having had "zero days" to fix it. Once a patch is released, the flaw becomes a known Vulnerability with a CVE number, but systems stay at risk until they are updated. Defence in depth, prompt patching, monitoring and limiting what each program can do reduce the harm of unknown flaws.
Why it matters
Ordinary protections that rely on a known signature or a patch cannot help against a zero-day, so detection has to rely on unusual behaviour: a document viewer starting a command shell, or a server making unexpected connections. Zero-days are valuable, are sold and are often used in targeted attacks, but once exploited widely they quickly become ordinary n-days (known flaws). The long tail of unpatched systems is where most real damage is done, so applying updates promptly still matters after the headlines fade.
Example
An invented timeline, with day 0 as the first attack:
2026-03-02 attackers begin exploiting the flaw (day 0)
2026-05-28 vendor first learns of it (day 87)
2026-06-10 patch released (day 100)
Users were exposed for 100 days, 87 of them without the vendor knowing, and 13 days passed between awareness and fix. After the patch, the flaw is no longer a zero-day, but unpatched machines remain vulnerable. Indicators gathered from the attacks can be shared as Malware signatures.
Common confusion
"Zero-day" describes how much warning the defender had, not how severe the flaw is. It is not the same thing as a CVE, which is just an identifier that can be assigned to flaws at any stage.