Zero-Day
A zero-day is a vulnerability that is unknown to the software vendor and therefore has no patch available. Attackers who discover zero-days can exploit them with no defenders able to protect patched systems. CISA KEV and EPSS track exploitation risk for both zero-days and known vulnerabilities.
Frequently Asked Questions
What is Zero-Day?
A zero-day is a vulnerability that is unknown to the software vendor and therefore has no patch available. Attackers who discover zero-days can exploit them with no defenders able to protect patched systems. CISA KEV and EPSS track exploitation risk for both zero-days and known vulnerabilities.
How is Zero-Day related to CVE (Common Vulnerabilities and Exposures)?
Zero-Day and CVE (Common Vulnerabilities and Exposures) are both key concepts in threat intelligence. CVE is a public catalogue of known cybersecurity vulnerabilities, maintained by MITRE and sponsored by CISA. Each entry has a unique CVE ID (e.g., CVE-2024-12345), a description, and references. CVE IDs are the universal language for tracking and patching specific vulnerabilities.
Related Terms
CVE (Common Vulnerabilities and Exposures)
CVE is a public catalogue of known cybersecurity vulnerabilities, maintained by MITRE and sponsored by CISA. Each entry has a unique CVE ID (e.g., CVE-2024-12345), a description, and references. CVE IDs are the universal language for tracking and patching specific vulnerabilities.
KEV (CISA Known Exploited Vulnerabilities)
The CISA KEV catalog lists CVEs that have been confirmed as actively exploited in the wild. US federal agencies are required to patch KEV vulnerabilities by mandated due dates. KEV status is the highest-urgency signal for vulnerability prioritization.
EPSS (Exploit Prediction Scoring System)
EPSS is a data-driven model from FIRST.org that estimates the probability a CVE will be exploited in the wild within the next 30 days. Scores range from 0 to 1 (0%–100%). EPSS helps prioritize patching by combining NVD data with real-world exploitation observations.
Put this intelligence to work
Query indexed indicators — IPs, domains, URLs, and hashes — in seconds.