A zero-day vulnerability refers to a hole in software that is unknown to the vendor. This security hole is then exploited by hackers before the vendor becomes aware and hurries to fix it—meaning the company has zero days to fix the problem or mitigate the risk before cybercriminals can potentially exploit it. The description provided in the question aligns with this definition, as the vulnerability is known to the company but has not been patched by the vendor yet.