Windows Security · Patch Tuesday & Vulnerabilities · Lesson 2 of 5

Zero-Days on Windows

Holes attackers find first, and why the days after a fix count.

A hole nobody had fixed yet

A zero-day is a vulnerability that attackers know about before the software maker has a fix ready. The name means the maker had zero days to prepare. An attack that uses one is a zero-day exploit.

On a Windows PC, zero-days often show up in a few places:

• The browser, because it opens content from any website, including bad ones.
• Parts of Windows that open or preview files. A booby-trapped document or shortcut file can be enough.
• The kernel, the core of Windows that controls everything else. A kernel bug can turn a small foothold into full control.

Going from limited rights to full control is called privilege escalation. Attackers often chain two bugs. One gets them in through a file or web page. A second gives them administrator rights or more. Many of the Exploitation Detected fixes on Patch Tuesday are this second kind.

Zero-days are rare and expensive to find. So they are usually used quietly against chosen targets first, such as companies or officials.

Once a fix comes out, the hole is no longer a zero-day. It is a known, patched hole. This is when the danger spreads. Criminals copy the attack and aim it at everyone who hasn't updated. The Mobile side called these older, already fixed holes n-days.

What can you do about a hole with no fix yet? Not much directly, and that is why layers matter. A standard everyday account, Microsoft Defender, SmartScreen and care with attachments each make an attack harder to finish. Then, the day a fix arrives, install it and restart.

CISA's exploited list and the gap

CISA is the Cybersecurity and Infrastructure Security Agency, the US government's main cyber defense agency. It keeps a free public list called the Known Exploited Vulnerabilities catalog, or KEV for short.

A hole goes on the KEV list only when there is evidence attackers are using it in the wild, which means in real attacks, not just in a lab. It also needs a clear way to fix it. Microsoft products, Windows especially, show up on the list often.

Each entry gives the CVE id, the product, a short description, what to do, and a due date. US federal agencies have to fix listed holes by that date. Everyone else can use the list as a simple rule: if it is on KEV, patch it first.

Now the key idea. Every fix has two dates that matter to you:

• The day the maker releases it.
• The day it is actually installed on your PC.

The time between them is the gap. During that gap the hole is public and the fix is public, yet your PC is still open. Attackers know that many people wait weeks. Some study each new patch to find the hole it closes, then attack the PCs that haven't caught up.

Closing the gap is simple for a home PC. Let Windows Update install on its own, restart when asked, and don't leave a waiting restart for days.

For a small office, add one step. After Patch Tuesday, look at the KEV list, or the Exploitation Detected rows. Make sure those fixes are on every PC first, then catch up on the rest.