Exploit

An exploit is the bridge between a vulnerability, which is a property of the code or configuration, and an attacker capability such as remote code execution, privilege escalation, authentication bypass or information disclosure. The vulnerability class largely determines the technique. Injection flaws (SQL, OS command, template injection, JNDI lookups as in Log4Shell, CVE-2021-44228) are exploited with crafted input strings. Memory-safety bugs in C and C++ code, such as stack and heap buffer overflows, use-after-free and type confusion, are exploited by corrupting memory so that control flow reaches attacker-chosen code. Logic flaws and misconfigurations often need no "payload" at all, only a specific sequence of requests.

Memory-corruption exploitation has been shaped by an arms race with mitigations. Non-executable memory (DEP/NX) stopped the injection of shellcode onto the stack, which led to return-oriented programming (ROP), chaining short instruction sequences ("gadgets") already present in the binary. Address space layout randomisation (ASLR) hides where those gadgets are, so modern exploits usually need a separate information-leak bug first. Stack canaries, control-flow integrity and hardware shadow stacks (Intel CET) raise the bar further. As a result, a working exploit against a hardened browser or phone is typically a chain of several bugs, for example a renderer bug plus a sandbox escape plus a kernel privilege escalation.

Maturity matters. A proof of concept demonstrates the bug, often just crashing the process; a weaponised exploit is reliable across versions and delivers a payload such as a web shell, a loader or ransomware. A zero-day is exploited before the vendor has a fix; an n-day targets a disclosed, patched vulnerability on systems that are still unpatched, which is the bulk of real-world exploitation. The EternalBlue exploit for MS17-010 was patched in March 2017, yet WannaCry and NotPetya spread widely with it months later.

Defenders use this to prioritise. A CVE identifier names the vulnerability and CVSS (currently v4.0) scores its technical severity, but neither says whether an exploit exists. FIRST's EPSS estimates the probability of exploitation in the next 30 days, and CISA's Known Exploited Vulnerabilities catalogue lists flaws with evidence of exploitation in the wild. Patch management, virtual patching in a WAF or IPS, attack-surface reduction and exploit mitigations in the OS are the controls; a vulnerability scanner finds the weakness, while the exploit is what turns it into a security incident. Malware is the payload an exploit often delivers, not the exploit itself.