Zero-day vs n-day vulnerabilities
Reviewed November 11, 2026 · figures computed from 1,780 CISA-listed CVEs in the 0dayNews dataset at build time
A zero-day is a vulnerability that is exploited, or publicly known, before the vendor has shipped a fix, so defenders have had zero days to patch. An n-day is one where a fix already exists and attackers exploit the gap between release and deployment.
The two terms
Zero-day describes the position of the defender. The flaw is being used, or is public, and no patch is available. Vendors and researchers often apply the term to the exploitation specifically ("exploited as a zero-day") rather than to the bug itself.
n-day means "n days since the fix". The patch has been out for a day, a month or a decade, and any system that has not applied it is still exposed. Many intrusions use n-days, because patching is slow and attackers can reuse the same flaw for years.
Where the line blurs
There is no formal definition, and usage varies. A flaw can be "zero-day" for a week and an n-day after the patch. Some outlets label a bug zero-day because it was exploited before disclosure even if a fix landed the same day.
What KEV data suggests
For 1,713 CISA-listed CVEs in our dataset with both an NVD publication date and a KEV date, the median gap is 260 days. 523 (31%) were listed within 30 days of publication and 789 (46%) more than a year after.
Read that with care: the KEV date is when CISA added the entry, not when exploitation began, and many of the oldest entries were added in bulk when the catalog launched in 2021. It does show that many entries were listed long after their CVE was published. It says nothing about whether any given product is still unpatched.