Researchers disclose a critical flaw in the VPN appliance the city uses, but the vendor has not released a patch yet and active exploitation is reported elsewhere. Which vulnerability class best fits?

A zero-day is a vulnerability exploited or publicly disclosed before a vendor patch or fix is available. Researchers disclosing a critical VPN appliance flaw with active exploitation elsewhere and no vendor patch yet places the city in the zero-day window: defenders know risk exists but lack the official remediation package. Compensating controls and threat intelligence drive response until a patch ships.

Typosquatting a construction vendor domain for payment fraud is BEC tradecraft. It is not an unpatched, newly disclosed VPN flaw.

Removable USB media dropped in a parking lot is a physical removable-media vector. Zero-day refers to patch-availability timing for a software/firmware flaw.

Unpatched browser plugins on clerk workstations after a fix already exists are ordinary patch-management failures on known, fixable client software—not zero-days. Availability of a fix is the distinguishing exam detail.

Exam caveat: Zero-day ≠ "critical CVE." The defining trait is absence of a vendor fix (or defender knowledge before the vendor). Once a patch exists and you simply have not applied it, the issue becomes unpatched/known vulnerability management. VPN appliances are high-value remote-access targets during zero-day events.

Operational check: subscribe to vendor PSIRTs and trusted intel, restrict VPN exposure, add MFA and geo/device checks, consider temporary alternative access paths, increase logging/IDS around the appliance, and prepare emergency change windows for when the patch arrives. Document compensating controls for auditors while civic remote access remains at elevated risk.