Log4Shell and the Vocabulary of Vulnerabilities: A Fact-Check and Field Guide

Late on the night of December 9, 2021, Alibaba Cloud’s security team publicly disclosed a remote code execution vulnerability in the Java logging library Log4j (CVE-2021-44228), forcing engineers across half the internet to crawl out of bed on a weekend and work overtime on emergency response. “Log4Shell” thus became the most famous vulnerability storm of the past decade: Check Point’s monitoring showed that over 48% of enterprise networks worldwide were hit by exploitation attempts (primarily scanning and probing) after disclosure; within 72 hours, attack attempts exceeded 800,000 cumulative occurrences, spawning more than 60 exploit variants.

After the storm passed, terms like 0day, 1day, nday, CVE, and CNVD began appearing everywhere in the news. This article traces its origins to a popular-science post on Zhihu (《一文读懂 0day、1day、nday、CVE、CNVD等漏洞世界的"暗语"》). The original article’s framework is worth reading, but upon fact-checking each claim, several figures and attributions contain errors. This article builds on its structure to do a “fact-check + supplement,” with every key figure re-verified against public sources.

I. 0day, 1day, nday: Three “Clock Readings” of the Same Vulnerability

These three terms don’t describe three different vulnerabilities — they describe the same vulnerability at different points in time. There are only two dividing lines: whether the vendor knows about it, and whether a patch is available.

• 0day (zero-day vulnerability): A vulnerability the vendor doesn’t know about and therefore has no patch for. Attackers striking now face defenders who have zero recourse — hence it commands the highest value. “0 days” means the defense side has zero preparation time. Note the spectrum: truly extreme 0days are exceedingly scarce; much of what’s traded under the “0day” label doesn’t actually meet that bar.
• 1day: The vulnerability has been publicly disclosed and the vendor has released a patch, but your systems haven’t been patched yet. This term describes the system’s remediation status, not “the vulnerability on the first day after discovery” — one of the most widespread misconceptions online equates it with “the vulnerability during the first day after public disclosure.”
• nday: The patch has been out for n days and the host remains unpatched. n can be 30, 300, or even 3,000. The security industry doesn’t actually have a standard definition that perfectly aligns with 0day/1day; the term is mostly used as a catch-all for “known, unpatched vulnerabilities.”

With this framework in mind, the following data points take on meaning: Google’s Threat Analysis Group (TAG) observed in 2024 that the average gap from vulnerability disclosure to first in-the-wild exploitation is only 16 days; an earlier automated study (Ellis & Fenske, 2021) found that the median “handoff time” for attackers to write an automated exploit after receiving a patch was just 22 seconds — the moment a patch is published, the countdown to exploitation begins in minutes. The critical variable on the attacker-defender axis was never who “knows” first — it’s who “patches” first.

II. A Closed 0day Price List, and the Market It Left Behind

Any discussion of 0day pricing inevitably circles back to one company: Zerodium. Known for posting transparent acquisition prices for vulnerabilities, its public price list before being taken down in 2021 was widely cited: Android full-chain zero-click remote code execution topped out at $2.5 million, iOS zero-click with persistence at $2 million, WhatsApp/iMessage zero-click at $1.5 million, with the vast majority of lower-tier vulnerability offers ranging from $2,500 to $2.5 million.

Two caveats apply when citing this table. First, prices fluctuate significantly with “market conditions”: the more researchers target a particular platform, the harder vulnerabilities are to find and the cheaper they become — Zerodium cut iOS vulnerability prices as early as 2019. Second, and more importantly: Zerodium announced it was ceasing operations in November 2025; any reference treating it as “current market rates” should be regarded with skepticism. The vulnerability acquisition market has been in turmoil: after Zerodium’s shutdown, Operation Zero and other well-known bounty programs have also entered archival status.

There’s also a telling price gap between legitimate and underground markets. Trend Micro’s ZDI (Zero Day Initiative) acquires and transparently discloses vulnerabilities, offering public acquisition prices of roughly $100,000–$150,000 for virtualization vulnerabilities like VMware ESXi; meanwhile, underground forums price comparable older vulnerabilities at over $1 million — the same class of vulnerability, with a nearly tenfold gap between legitimate channels and underground markets.

III. The Real High-Frequency Threat: “Old Holes” Two Years and Beyond

Compared to the rare and elusive 0day, what attackers actually rely on day-to-day are ndays. Trend Micro’s report from the first half of 2026 compiled statistics on vulnerability exploit transactions in the underground market: of the exploits being sought for purchase, 70.14% targeted vulnerabilities that had existed for two years or more; among exploits on sale, 68.18% corresponded to entries in CISA’s Known Exploited Vulnerabilities (KEV) catalog.

Exposure surface scanning tells the same story: Shodan and similar search engines still surface over 270,000 devices with exposed SMBGhost (CVE-2020-0796) server ports, along with 88,652 Heartbleed-affected hosts — a vulnerability from 2014!

The original Zhihu article’s mention of “Eternal Blue” isn’t wrong (MS17-010, publicly disclosed in 2017, and still referenced repeatedly today), but this claim lacks dedicated statistical backing from frontline vendor reports in recent years. Harder evidence lies in the KEV catalog itself: of the entries newly added by CISA in 2025, 94 are vulnerabilities from 2020 or earlier, of which at least 24 were actively exploited by ransomware in their original year. The oldest entry still in the catalog and still being exploited is a Windows privilege escalation vulnerability from 2002, CVE-2002-0367 (known to be used by ransomware). It’s worth noting that QiAnxin’s first-half 2025 report offered a seemingly contradictory figure: KEV inclusion volume by vulnerability year peaked in 2022 and then declined for three consecutive years, suggesting “the stock of existing vulnerabilities is being converged.” This doesn’t contradict “a record-breaking 245 new entries” — one statistic is by vulnerability year, the other by year of KEV listing, and they use different baselines. Both sides actually converge on the same conclusion: the most active threats in real-world attacks are always those long-in-the-tooth vulnerabilities whose exposure surfaces persist.

IV. The CVE “ID Card” Is Being Overwhelmed by AI-Era Vulnerability Volume

CVE (Common Vulnerabilities and Exposures) assigns every publicly disclosed vulnerability a globally unique identifier in the format CVE-Year-Sequence. A remarkably widespread misconception is that “year = year of discovery” — the actual rule is: the year represents the year the identifier was reserved or publicly disclosed, and has nothing to do with when the vulnerability was discovered. Take CVE-2021-44228: 2021 indicates it was publicly disclosed in December 2021 (not 2024, a common typo). The identifier itself conveys no severity rating — it’s purely for “registration.” Assessing risk requires NVD’s scoring and KEV’s endorsement.

Identifiers are issued by CNAs (CVE Numbering Authorities), which include vendors, security firms, and national-level institutions. After a 2016 system reform, the number of CNAs expanded rapidly, reaching 543 by August 2026. This brought an explosive increase in identifier output: approximately 50,000 new CVE records were publicly published in 2025; CVE’s official forecast for 2026 projects a median of roughly 59,000 and an upper bound as high as 118,000. The driving force behind this growth is AI: after GitHub began operating as a CNA in 2025, it contributed over 7,000 records that year; in 2026, OpenAI and Anthropic also joined the CNA pilot program, taking responsibility for vulnerabilities in their own code.

The volume surge has overwhelmed the middle of this pipeline. MITRE, which operates the CVE system, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) sparked a “cliff-edge crisis” in April 2025 when their contract renewal was thrown into uncertainty. The bigger chain reaction occurred at NVD (the National Vulnerability Database, operated by an entity under NIST): the database had long enriched every CVE record with CVSS scores, affected products (CPE), and other “enrichment” data, but starting April 15, 2026, it shifted to a focused strategy — prioritizing enrichment for high-severity and in-the-wild-exploited entries, while marking the rest as “Not Scheduled” and no longer guaranteeing timely analysis completion. Under dual pressure on funding and staffing, the industry has even begun discussing alternative governance frameworks such as the CVE Foundation, GCVE, and EUVD. The CVE “ID card” remains authoritative, but the support system behind it is overloaded — something every person citing CVE numbers should keep in mind: having an identifier ≠ having a score ≠ having a remediation priority.

V. Five Vulnerability Databases: A “Orientation + Debunking” Cheat Sheet

• CVE: The international “ID card” — registers only, no scoring. Covered above.
• NVD (operated by NIST/CSRC): CVE’s “annotator” and query portal, providing CVSS scores, CPE matching, and reference links. Enrichment scope narrowed starting April 2026 (see previous section).
• KEV (maintained by CISA): The “Known Exploited Vulnerabilities” catalog — only includes vulnerabilities with evidence of real-world attacks, making it the most practically useful patch-priority list on the internet. As of August 31, 2026, it contained 1,687 entries; 245 new entries were added in 2025 alone, a historical record. The standard practice for security teams: KEV-listed + exposure-surface hit = fix now.

• CNVD (国家信息安全漏洞共享平台, National Information Security Vulnerability Sharing Platform): Co-built by the National Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT/CC) in cooperation with telecom operators, security vendors, and software enterprises, originating around 2001. It is China’s foundational infrastructure for collecting and publishing vulnerability information and coordinating emergency response. Vulnerabilities are classified as high/medium/low severity.
• CNNVD (国家信息安全漏洞库, National Information Security Vulnerability Database): Built and operated by the China Information Technology Security Evaluation Center (中国信息安全测评中心), officially launched on October 18, 2009, with a four-tier risk assessment system. The original Zhihu article’s claim that it was “led and managed by the Ministry of Public Security” does not match the official public description — this is the most commonly misattributed ownership question between the two national vulnerability databases. Both maintain their own numbering systems and map to CVE, and neither is a CNA: China’s approximately 24 CNAs are almost exclusively vendors (such as Huawei), not regulatory bodies.

One-line summary: To look up “what is it,” check CVE/NVD; to see “who’s been actually hit,” check KEV; for domestic reporting and emergency response, use CNVD and CNNVD.

VI. If You Only Remember Three Things, Remember These

1. Prioritize by remediation status — don’t be intimidated by jargon. The real day-to-day threat is nday, not 0day. Check your exposure surface against the KEV catalog — KEV-listed vulnerabilities get patched first.
2. The patch window is measured in days; its size is up to you. The average time from disclosure to in-the-wild exploitation is 16 days, but once a patch is available, attackers deploy automated exploitation in seconds. For comparison, roughly 30% of affected Log4j instances remained unpatched three months after disclosure — patch procrastination is the norm, not the exception.
3. Old vulnerabilities come back when you’ve forgotten about them. Eternal Blue has been publicly disclosed for nearly a decade; and the KEV catalog still contains a 2002 vulnerability being actively used by ransomware. Regularly running exposure surface scanning tools (like self-checks from a Shodan perspective) to see what you’re actually exposing on the public internet is the most cost-effective form of self-protection.

Corrections and Sources

Cross-referencing the original article with public materials, this article corrects the following widely circulated claims, for readers’ easy verification:

1. “Within 72 hours of public disclosure, 30% of enterprise networks worldwide were attacked” — The 30% figure actually comes from Qualys’s statistic that “approximately 30% of instances remained unpatched after 3 months”; Check Point’s figure is that over 48% of enterprise networks were subjected to exploitation attempts (primarily scanning and probing), with over 800,000 cumulative attempts within 72 hours.
2. “CNNVD is led and managed by the Ministry of Public Security” — The official description states it is operated by the China Information Technology Security Evaluation Center.
3. “1day refers to vulnerabilities within the first day after public disclosure” — 1day refers to the state of “publicly disclosed, patch available, but system unpatched,” and has nothing to do with any number of days.
4. CVE identifier “year = year of discovery” — The rule is the year of reservation or public disclosure (and the original article also mistakenly wrote CVE-2021-44228’s year as 2024).
5. “Approximately 40% of servers worldwide have unpatched nday vulnerabilities” (attributed to a QiAnxin report) — This figure could not be traced in QiAnxin’s publicly available reports; cautious citation is advised.

Data sources: CVE.org, NVD, CISA KEV, Check Point Research, Google TAG, Trend Micro (ZDI) first-half 2026 vulnerability exploit transaction report, Qualys, Shodan, and the official public introductions of CNNVD/CNVD. If you maintain servers, “check against KEV and patch through it” is the single most important next step after reading this article.

This article originated from the Zhihu column post 《一文读懂 0day、1day、nday、CVE、CNVD等漏洞世界的"暗语"》. All key figures in this article have been re-verified; where they conflict with impression-based “common knowledge,” defer to the cited sources.

Appendix: Two illustration styles compared. This article’s cover uses a dark-terminal-style custom card newly tried for this piece (see the opening cover image); below is an information-card style generated by the LynxPipe pipeline — same title and key points, different visual language. Both styles are presented side by side here for comparison reference.