Zero-Day Vulnerability

A zero-day vulnerability (often written 0-day) is a security flaw in software, firmware, or hardware that is unknown to the party responsible for patching it — the vendor has had 'zero days' to fix it. The term encompasses several related concepts: a vulnerability that is unknown to the vendor, a vulnerability for which a public exploit exists before a patch, and a vulnerability being actively exploited in the wild before any fix is available. These situations often overlap. Zero-days are highly valuable to attackers because defenders have no patch to deploy and must rely on mitigations such as network segmentation, WAF rules, or temporary feature disablement.

Article 14 of the CRA establishes a 24-hour notification requirement when a manufacturer becomes aware that a vulnerability in its product is actively exploited. An actively exploited zero-day is the paradigm case for this obligation. The notification must go to ENISA and the relevant national CSIRT. Within 72 hours, the manufacturer must submit an 'early warning' with preliminary findings, and a final report within 14 days. This notification cascade is designed to allow CSIRTs to warn other organisations using the same product. Manufacturers must establish internal processes to detect and escalate zero-day information — including monitoring threat intelligence feeds and maintaining contact with sector-specific ISACs.

When a zero-day affecting your product is identified, the response sequence is:

1. Confirm and isolate — validate that the vulnerability is real and assess the exploit's reach and reliability.
2. Classify — determine CVSS Base Score and assess active exploitation status.
3. Notify — if actively exploited, trigger the Article 14 notification to ENISA/CSIRT within 24 hours.
4. Develop a mitigation — if a full patch is not immediately available, identify and publish interim mitigations (firewall rules, configuration changes, workarounds).
5. Develop and test the patch — prioritise over normal release cycles; consider an out-of-band security release.
6. Publish a CSAF advisory — disclose the vulnerability, its severity, and remediation steps.

An N-day vulnerability is one where a CVE and patch exist but systems remain unpatched. In practice, N-days are often more operationally dangerous than zero-days because:

• Exploit code is typically available shortly after CVE publication.
• Most organisations have large unpatched backlogs.
• Attackers systematically scan for unpatched systems using CVE data.

For CRA compliance, manufacturers must address both: zero-days trigger immediate notification; N-days require timely patch releases and advisory publication. The CISA Known Exploited Vulnerabilities (KEV) catalogue is a useful operational signal for identifying N-days with confirmed active exploitation that may also trigger Article 14 notification obligations.