A zero-day vulnerability in Microsoft Windows may already have been exploited.