What is a vulnerability called that is released before a patch comes out?

A zero-day vulnerability refers to a security flaw in software or hardware that is publicly disclosed or exploited by threat actors before the vendor becomes aware of it or releases an official software patch. The term "zero day" signifies that the developers have had zero days to fix and address the security vulnerability since its discovery or exposure. In Industrial Control Systems (ICS) and SCADA environments, zero-day vulnerabilities present severe operational risks because legacy control hardware and proprietary software often require lengthy testing and validation cycles before updates can be safely deployed, leaving critical infrastructure exposed to potential exploitation during the window of vulnerability.

A. Initial: This is not an established cybersecurity term for an unpatched security vulnerability prior to vendor patch release.
B. Pre-release: Pre-release refers to software builds distributed prior to formal public release, not unpatched security vulnerabilities.
D. First: This is a general ordinal term and does not denote an unpatched or active security vulnerability state.

NIST SP 800-82 Rev. 2, Guide to Industrial Control Systems (ICS) Security, Section 3.2 (Vulnerability Management), p. 3-4.

CISA ICS-CERT Advisory Guidelines, Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies, Recommended Practices, pp. 11–13.