An attacker used an undocumented and unknown application exploit to gain access to a file server. Which of the following BEST describes this type of attack?

Integer overflow is a specific class of programming vulnerability where arithmetic exceeds the storage capacity of a data type; it describes a vulnerability mechanism, not the novelty or disclosure status of an exploit.

Cross-site scripting (XSS) is a known web application attack category involving injection of malicious scripts into pages viewed by other users, not an unknown undocumented exploit.

A zero-day attack targets a software vulnerability that has not yet been publicly disclosed or patched by the vendor, giving defenders 'zero days' to prepare or respond. The term 'undocumented and unknown' in the question directly maps to this definition, as the vendor and security community have no prior knowledge of the flaw. Zero-day exploits are especially dangerous because no signature-based defenses exist at the time of attack.

Session hijacking involves stealing or forging valid session tokens to impersonate an authenticated user; it is a well-documented attack technique, not an unknown exploit.

XML injection is a known attack that manipulates XML parsers through malicious input; it describes a specific documented attack vector, not an undisclosed exploit.