"Day Zero" is the day on which the interested party, presumably the vendor of the targeted system, learns of the vulnerability.