A Chief Executive Officer has learned that an exploit has been identified on the web server software, and a patch is not available yet. Which of the following attacks MOST likely occurred?

A brute-force attack involves systematically trying many passwords or phrases, not necessarily exploiting an unknown software vulnerability.

A zero-day attack exploits a software vulnerability that is unknown to the vendor or for which a patch has not yet been released or deployed. The scenario explicitly states an exploit was identified, and a patch is not available, which perfectly matches the definition of a zero-day vulnerability being exploited.

A denial-of-service (DoS) attack aims to make a service unavailable, which could be a result of various attack vectors, but not specifically tied to an unpatched, newly discovered exploit.

An on-path attack (formerly Man-in-the-Middle) involves intercepting and potentially altering communication between two parties, which is a different type of attack than exploiting a software vulnerability.