A zero-day vulnerability is a software flaw the vendor does not yet know about, which means no patch exists and defenders have zero days to prepare. Whoever discovers it first, a researcher or an attacker, holds a window in which the flaw can be exploited without any signature-based defense catching it.
That is what makes zero-days so dangerous: the entire patch-management model assumes a fix is available, and here it is not. Detection has to fall back on behavior. Tools that flag unusual process activity, unexpected outbound traffic, or anomalous access patterns can catch an exploit in action even when nobody knows the underlying bug. This is the practical argument for defense in depth. Layered controls, least privilege, and network segmentation limit how far an attacker can travel with a zero-day before something else notices. Once a fix ships, the flaw stops being a zero-day and becomes an ordinary patching race.
How are zero-day vulnerabilities tested on the CISSP?
Zero-days appear in Domain 6: Security Assessment and Testing and in Security Operations. Candidates should understand managing risk from unknown flaws through compensating controls and layered defense. NIST tracks disclosed vulnerabilities in the National Vulnerability Database.
Related terms: Vulnerability, Patch Management