Vulnerabilities and Patch Management

A zero-day vulnerability is a software flaw that is unknown to the vendor responsible for fixing it, meaning no patch yet exists at the time it is discovered or exploited — the term refers to the "zero days" the vendor has had to respond. Because no defense specifically targets them, zero-days are highly valuable both to attackers and, controversially, to specialized brokers and government agencies willing to pay large sums to acquire them. The EternalBlue exploit, originally developed by the U.S. National Security Agency to target a then-unknown flaw in Windows file-sharing software, was leaked in 2017 by a group calling itself the Shadow Brokers and was subsequently repurposed to power both WannaCry and NotPetya; Stuxnet, the sophisticated cyberweapon discovered in 2010, made unusually heavy use of zero-days, reportedly exploiting four of them at once.