Zero-Day Exploit.

A zero-day exploit weaponizes a vulnerability before defenders have any official mitigation. Because there is no patch, no signature, and often no public detail, even well-instrumented organisations may be blind to it. The window closes only once the vendor ships a fix and defenders deploy it — until then the exploit runs against every affected system.

Zero-days power the most consequential intrusions. Stuxnet (2010) chained four Windows zero-days — including the LNK shortcut flaw CVE-2010-2568 — to jump air-gapped networks and damage Natanz centrifuges. Operation Aurora (2009) used an Internet Explorer zero-day (CVE-2010-0249) against Google and dozens of firms. FORCEDENTRY (CVE-2021-30860), found by Citizen Lab in 2021, exploited an integer overflow in Apple's CoreGraphics JBIG2 parser to bypass the iMessage BlastDoor sandbox in a zero-click chain that installed NSO Group's Pegasus spyware. Full remote chains against modern phones and browsers are traded by brokers such as Zerodium and Crowdfense for millions of dollars.

flowchart LR
  A[Researcher/attacker finds bug] --> B{Disclosed to vendor?}
  B -->|No| C[Zero-day: weaponize + exploit in the wild]
  B -->|Yes| D[Vendor develops patch]
  C --> E[Vendor eventually learns of exploitation]
  E --> D
  D --> F[Patch released]
  F --> G[Defenders deploy: window closes -> N-day]

Because prevention alone cannot stop the unknown, detection leans on behavioural analytics (EDR/XDR), exploit mitigations (Intel CET, ARM PAC/MTE, sandboxing), application allow-listing, and aggressive least privilege so a successful exploit yields limited capability. Programs like CISA's Known Exploited Vulnerabilities catalog accelerate patching once a zero-day becomes public.