A zero-day vulnerability refers to a security flaw or weakness in software, hardware, or firmware that is unknown to the vendor or developer and has not yet been patched or fixed.