A zero-day vulnerability refers to a software vulnerability or weakness that is unknown to the vendor or the public. It poses a significant risk as attackers can exploit it before a patch or security measures are available, leaving systems exposed and at risk.