Exploit

An exploit is a piece of code, a crafted payload, or a defined technique that leverages a specific vulnerability to make a system behave in an unintended way — commonly to gain unauthorised access, execute arbitrary code, escalate privileges, or cause a denial of service. Exploits range from theoretical proof-of-concept demonstrations, which confirm a vulnerability is real but may require significant adaptation to be weaponised, to fully operational exploit kits that automate attack delivery with no technical skill required. The existence of a public exploit transforms an abstract vulnerability into an immediate, actionable threat and dramatically compresses the window manufacturers have to deploy a patch.

The EU Cyber Resilience Act requires manufacturers to monitor and address vulnerabilities in their products without undue delay (Article 13). When a public exploit exists, regulators and market surveillance authorities treat the threat as elevated and expect accelerated remediation timelines. ENISA's vulnerability handling guidance notes that the presence of a known exploit is a key factor in severity prioritisation. Manufacturers who are slow to patch exploitable vulnerabilities face enforcement action and reputational harm. Under Article 14, manufacturers are also required to notify ENISA within 24 hours if an actively exploited vulnerability is discovered in their product.

Effective exploit risk management involves several parallel workstreams. Manufacturers should maintain a Software Bill of Materials (SBOM) to rapidly identify components affected by newly disclosed vulnerabilities. Continuous vulnerability scanning of products against feeds such as the NVD and CISA KEV catalogue flags exploited vulnerabilities early. Exploit intelligence feeds provide real-time signals when proof-of-concept code is published. Internally, threat modelling during design reduces the attack surface that exploits can target. Secure coding practices — input validation, memory-safe languages, and least-privilege architecture — reduce the number of exploitable conditions present in shipped products.

Manufacturers frequently conflate the existence of a vulnerability with the existence of an exploit, treating all unpatched CVEs with equal urgency regardless of exploitability. Conversely, some deprioritise vulnerabilities marked 'no known exploit' and are then caught off guard when a proof-of-concept emerges days later. Another common error is failing to monitor exploit databases and threat intelligence sources, so that the manufacturer learns of active exploitation from a customer complaint rather than from proactive monitoring. Exploit status should be a primary factor in CVSS environmental scoring and patch prioritisation decisions.