Zero-day exploits are security holes that exist and are used by bad actors, but aren’t yet known to you, or anyone capable of closing the hole. The clock to patch the hole doesn’t start running until the exploit is known: it stands at zero days until the good guys know it exists.

What zero-day exploits exist for ssh?

By definition, you don’t know. So, you block root login, and hope the bad actor doesn’t also know a zero-day for sudo.