An exploit is code, data, or a technique that takes advantage of a vulnerability to make a system behave in a way its owner or developer did not intend. An exploit may bypass authentication, expose data, increase privileges, or run commands.
Vulnerability, exploit, and payload
- A vulnerability is the weakness, such as a coding error, unsafe configuration, or design flaw.
- An exploit is the method used to trigger that weakness.
- A payload is what the attacker does after exploitation, such as installing ransomware or creating an account.
These terms describe different stages. A vulnerability can exist without a public exploit, and an exploit can fail when the software version or environment does not match its assumptions.
Common exploit targets
- Internet-facing services, VPN appliances, and web applications.
- Browsers, document readers, media parsers, and email clients.
- Operating-system kernels, drivers, and local services.
- Cloud permissions, exposed management panels, and insecure APIs.
An exploit kit automates checks for several client-side weaknesses and attempts a matching exploit. See Exploit Kit for that specific delivery method.
Zero-day and known exploits
A zero-day exploit targets a vulnerability before a practical fix is available or before defenders have had time to deploy it. Most real incidents, however, do not require a zero-day; attackers often use known weaknesses on systems that remain unpatched. Read Zero-Day Attack for the distinction.
How to reduce exploitation risk
- Keep an inventory of software and apply security patches based on exposure and severity.
- Remove unsupported software and disable services that are not needed.
- Use least privilege, network segmentation, and MFA for administrative access.
- Enable operating-system exploit protections and endpoint monitoring.
- Validate application input and keep third-party dependencies current.
- Monitor unusual child processes, crashes, privilege changes, and outbound connections.
If exploitation is suspected, isolate the affected system, preserve logs and memory evidence where possible, reset exposed credentials, and patch only after evidence needed for the investigation has been collected.