A zero day attack happens when a hacker takes advantage of an unpatched or previously unknown vulnerability for the first time (also known as a zero day vulnerability).  Some examples of zero day exploits include:
A known vulnerability that had never been previously exploited.
New or undetected malware.
A previously unknown vulnerability that is exploited.
Critical system vulnerabilities and exposures are tracked by some organizations and websites to distribute to others. They maintain lists of these and then release patches that will fix them. Once the weakness in the software is patched, it is no longer considered a zero day vulnerability.
It is important to note that sometimes, vulnerabilities are only discovered once people figure out how to exploit them. Other times, the vulnerability is known (hypothetically) but it is not known how that vulnerability could possibly be exploited. This is why there is often a gap or delay between when a zero day vulnerability is discovered and when a zero day attack occurs.
Your average antivirus and anti-malware software can only seek out what they know for certain is out there, therefore, they cannot protect against zero day attacks and vulnerabilities.