Zero-Day Vulnerability

PCIComplianceHubLast updated

A security flaw in software or hardware that is unknown to the vendor and has not yet been patched. Zero-day vulnerabilities can be exploited by attackers before the vendor releases a fix, potentially compromising systems and data, including cardholder data. Addressing zero-day vulnerabilities is important for maintaining PCI DSS compliance and overall information security.

Applies to. PCI DSS v4.0.1 does not name zero-days. They enter through the Requirement 6 vulnerability identification process, which asks the entity to learn of new vulnerabilities and rank each by risk, and through patching, which a zero-day by definition cannot satisfy until the vendor releases a fix. Until then the entity relies on its other controls, such as anti-malware, network security controls and change detection.
Related. Vulnerability, Exploit, Patch, Risk Ranking, Vulnerability Management
Sources. PCI DSS v4.0.1 (June 2024)