risk
Zero-day exploitation
Adversary employs attacks that exploit as-yet-unpublicized vulnerabilities (targeted, based on reconnaissance, or nontargeted), compromising systems before any patch or signature exists.
In catalog since 2026-09-17T22:28:00Z · Last changed 2026-09-17T22:28:00Z (f368a6cce277)
Record JSON · Open in map · Data retrieval guide
Catalog revision: 791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4. A connection does not establish full coverage.
Attributes
- category
- cyber_security
- domain
- Vulnerability & Patch Management
- Secure Development (SDLC) & Application Security
- taxonomy
- nist-800-30-threat-event
- iso-27005-threat
- inherent_rating
- high
Details
- risk_id
- vuln-zero-day
- category
- cyber_security
- likelihood
- medium
- impact
- high
- inherent_rating
- high
- treatment
- mitigate
- taxonomies
- nist-800-30-threat-event
- iso-27005-threat
Source
No record-specific source URL is provided.
Connections
- UC-VULN-06 — Verify software, firmware, and information integrity mitigates Zero-day exploitation
- strength
- related
- rationale
- Continuous integrity monitoring surfaces the unexpected changes left by unknown-vulnerability exploitation as adverse events.
- UC-SDLC-04 — Engineer systems with secure architecture and design mitigates Zero-day exploitation
- strength
- primary
- rationale
- Defense in depth, fail-safe defaults and execution-domain isolation limit exploitation of unknown, unpatched vulnerabilities.
- UC-BCDR-16 — Participate in cyber threat intelligence sharing mitigates Zero-day exploitation
- strength
- related
- rationale
- Exchanging IOCs/TTPs gives early warning of novel exploits, but the sharing arrangement feeds detection/blocking rather than itself being the operative zero-day defense.
- UC-ASSET-09 — Receive, analyze, and act on threat and vulnerability intelligence mitigates Zero-day exploitation
- strength
- related
- rationale
- Threat-intel feeds give early IOC/TTP warning of novel exploits, enabling detection before any signature or patch exists.
- UC-VULN-03 — Remediate identified flaws within defined timeframes mitigates Zero-day exploitation
- strength
- related
- rationale
- Time-bound patch deployment shrinks the exposure window once a patch ships for a formerly-unknown vulnerability.
- UC-VULN-05 — Block malware, spam, and phishing across all systems mitigates Zero-day exploitation
- strength
- related
- rationale
- Email/web filtering and behavioral anti-malware block delivery of phishing-borne and novel exploit payloads lacking a signature.
- UC-VULN-08 — Engineer systems to fail predictably and safely mitigates Zero-day exploitation
- strength
- related
- rationale
- On exploit-induced failure, failing to a known safe state preserves security protections and blocks unsafe continuation, limiting impact.
- UC-SDLC-05 — Enforce secure coding and input validation standards mitigates Zero-day exploitation
- strength
- related
- rationale
- Secure coding reduces the count of latent, as-yet-undiscovered vulnerabilities in own code.
- UC-VULN-11 — Embed taint mechanisms to detect data exfiltration mitigates Zero-day exploitation
- strength
- related
- rationale
- Taint activations detect exfiltration from exploitation of unknown vulnerabilities that preventive and signature controls missed.
- UC-VULN-09 — Employ non-persistence and information-resilience techniques mitigates Zero-day exploitation
- strength
- related
- rationale
- Periodic non-persistent refresh evicts adversaries who exploited unknown vulnerabilities, limiting dwell when no patch exists.
- UC-VULN-07 — Harden runtime error handling, output filtering, and memory mitigates Zero-day exploitation
- strength
- primary
- rationale
- DEP/ASLR memory protections block reliable exploitation of unknown memory-corruption vulnerabilities before any patch exists.