Also known as: n day vulnerability · known vulnerability · one-day
An n-day is a vulnerability that has already been publicly disclosed and patched, but remains exploitable on systems that have not yet applied the update.
N-days are the workhorse of real-world compromise. Once a patch is published, attackers can diff the fix against the previous version to reconstruct the vulnerability, often producing a working exploit within hours or days. Meanwhile, organisations typically take weeks or months to deploy patches across a full estate.
This asymmetry is why patch latency, not exploit sophistication, is the dominant risk factor for most organisations. Defending against n-days is unglamorous work — inventory, patch pipelines, maintenance windows — but it eliminates far more real risk than anything aimed at novel attacks.
Zero-Day
A zero-day is a software vulnerability that attackers know about and exploit before the vendor has released a patch, leaving defenders zero days to prepare a fix.
CVE
CVE (Common Vulnerabilities and Exposures) is a public catalogue that assigns a unique identifier, such as CVE-2026-31337, to each publicly disclosed software vulnerability so that everyone can refer to the same flaw unambiguously.
Patch Tuesday
Patch Tuesday is the second Tuesday of each month, on which Microsoft and several other major vendors release their scheduled batch of security updates, giving administrators a predictable cadence for planning maintenance.
Exploit
An exploit is code or a technique that takes advantage of a specific vulnerability to cause unintended behaviour, such as executing attacker-supplied code, bypassing authentication, or crashing a service.
Vulnerability Management
Vulnerability management is the ongoing process of identifying, prioritising, remediating, and verifying fixes for security weaknesses across an organisation's systems and software.