A vulnerability being actively exploited before the vendor has released a fix — "zero days" of warning.