NewsCompaniesFlawsGuides
Get the app

What is a zero-day vulnerability? Plain answers, and what a household should do

A long read from HARD News · · 5 min read

A zero-day is a flaw attackers know about before the maker has a fix. What the word means, how it differs from a flaw that is merely unpatched, and the few things that protect a household.

A zero-day vulnerability is a flaw in software or hardware that attackers can use before its maker has released a fix. The name counts the days the maker has had to respond: zero. NIST defines a zero-day attack as one that exploits a previously unknown vulnerability.[1]

Most flaws in the news are not zero-days. The difference decides what you can do about them.

A zero-day is not the same as an unpatched flaw

  • Zero-day. No fix exists yet. You can’t update your way out of it. Defence rests on the maker’s quick fix and on limiting what a successful attack can reach.
  • Known flaw, fix available. Sometimes called an n-day. The fix exists, and the attack works only on devices that haven’t installed it. Updating closes it.

Security firm Sekoia’s 2026 report on a Russian-linked campaign against iPhones and Android phones is a clean example of the second kind: every flaw used had already been fixed by Apple and Google, so fully updated phones were not affected.[3] See HARD’s alert on that campaign.

A flaw being exploited right now

On 6 November 2026 SonicWall published an advisory for CVE-2026-19868, a flaw in the VPN login of its SonicOS firewalls. A person with valid credentials for another sign-in method could get around SAML sign-in. SonicWall fixed it in SonicOS 7.3.4-7013 (Gen7) and 8.2.3-8015 (Gen8), and CISA added it to its list of flaws known to be exploited.[2]

Whether it was a zero-day is not stated: SonicWall says only that it investigated a report of possible exploitation and has shared no details.[2] That is typical. The label “zero-day” depends on what the attacker knew and when, which outsiders often can’t see. What matters to you is the status that is stated: exploited, and a fix is available. The alert has the steps.

Who finds zero-days

Researchers, the makers’ own security teams and criminals or state-backed groups all hunt for flaws. A researcher who reports a flaw privately gives the maker time to fix it first. An attacker who keeps it secret can use it until it is noticed. Once it is public and fixed, it stops being a zero-day and becomes an ordinary known flaw that anyone can copy against devices that haven’t updated.

What a household should do

  1. Turn on automatic updates on phones, computers, the home router and smart TVs. A zero-day fix helps only the devices that install it. Check HARD’s updates page for the latest versions.
  2. Update parents’ and relatives’ devices too. Devices left behind are what attackers copy known attacks against.
  3. Use two-step login with an authenticator app or a hardware key on email, banking and your password manager. A second step helps if your password is stolen. A stolen session can bypass it; if you suspect session theft, use a trusted device to sign out all other sessions.
  4. Use a different password for each account, so one stolen password doesn’t open the rest.
  5. Retire anything the maker no longer updates. An old router or camera with no more fixes is permanently exposed to any flaw found in it.
  6. When a named flaw hits a product you use, act on the vendor’s advice that day: update, or apply the stated mitigation.

Questions people ask

Can I protect myself from a zero-day?

Not fully, because no fix exists yet. You can shrink the risk: keep everything updated so you get the fix the day it lands, use two-step login, and avoid unknown links and files.

Is every exploited flaw a zero-day?

No. Many attacks use flaws that already have fixes and succeed only against devices that haven’t updated.[3]

What does CISA’s list of known exploited flaws mean?

It lists flaws with evidence of attacks in the wild. Being on it says a flaw is being used, not that it was a zero-day.[2]

See also

References

  1. ^ NIST Computer Security Resource Center. “Zero-day attack (glossary)”, Nov 2026.NIST's definition: an attack that exploits a previously unknown hardware, firmware or software vulnerability.
  2. ^ BleepingComputer. “SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks”, Nov 2026.CVE-2026-19868: fixed versions, CISA's listing as exploited, and that SonicWall shared no details of the exploitation.
  3. ^ BleepingComputer. “Hackers use n-day exploits in zero-click attacks on iOS, Android devices”, Nov 2026.Sekoia's findings: a campaign that used only flaws Apple and Google had already fixed.

Sources checked 7 November 2026. The SonicWall article does not say the flaw was a zero-day, so this page uses it as an exploited flaw with a fix, not as a confirmed zero-day.