A computer exploit is a technique, program, sequence of actions or piece of code that takes advantage of a weakness in software, hardware, configuration or a security control to produce behaviour that was not intended by the system's designer. The underlying weakness is generally called a vulnerability, while the method used to take advantage of that weakness is the exploit.
The distinction is important: a vulnerability is the condition that creates an opportunity, whereas an exploit is the practical means of using that opportunity. Exploits can target operating systems, applications, browsers, network services, firmware, authentication mechanisms, memory-management errors, access controls and many other components. An exploit does not necessarily involve malware, and security researchers commonly create proof-of-concept exploits to demonstrate that a vulnerability is real.
Exploits can produce different outcomes depending on the vulnerability being targeted. A memory-safety flaw may allow an attacker to corrupt program memory and potentially execute attacker-controlled instructions. An authentication bypass can permit access without valid credentials. A privilege-escalation exploit can transform limited user access into administrative or system-level access. A path-traversal exploit can allow access to files outside an application's intended directory. An injection exploit can cause an application to interpret attacker-controlled input as commands or queries. A cross-site scripting exploit can cause a web application to execute attacker-controlled script in another user's browser context. The exploit is therefore defined by the security weakness and intended effect rather than by a single programming language or attack tool.
Exploitation generally follows a chain of technical conditions. The attacker first needs access to a vulnerable component or an input path that reaches it. The exploit then supplies specially constructed input or performs actions that cause the component to behave incorrectly. If successful, the attacker may obtain code execution, access protected data, bypass authentication or alter system state. Some exploits require no user interaction, while others depend on a victim opening a document, visiting a webpage or running an application. Some vulnerabilities are remotely exploitable over a network, whereas others require local access. Exploit reliability also varies: a proof-of-concept that demonstrates a crash may not provide reliable code execution, and environmental differences such as operating-system versions, mitigations and configuration can affect whether exploitation succeeds.
Exploits are commonly classified by the weakness they target and the stage of an attack in which they are used. Remote-code-execution exploits can cause a vulnerable service to run attacker-controlled instructions remotely. Local privilege-escalation exploits are used after initial access to obtain greater permissions. Client-side exploits target software that processes attacker-controlled content on a user's device, such as browsers or document readers. Kernel exploits target operating-system kernel weaknesses and can provide powerful privileges.
Web exploits target application logic, input handling or authentication. Exploit chains combine multiple vulnerabilities or techniques, with one weakness providing access that enables exploitation of another. Security researchers, penetration testers and attackers may use similar technical exploit concepts, but authorisation and purpose distinguish legitimate testing from unauthorised intrusion.
Exploit development can involve vulnerability analysis, reverse engineering, debugging, protocol analysis, code auditing and careful construction of input. Modern operating systems use mitigations intended to make exploitation harder, including address-space layout randomisation, non-executable memory protections, control-flow integrity, sandboxing, privilege separation, code signing and hardware-assisted protections. These mechanisms do not eliminate vulnerabilities; they can instead change the conditions required for successful exploitation.
For example, a memory-corruption vulnerability that once directly enabled reliable code execution may require additional information disclosure or a separate technique to bypass modern mitigations. Exploitability is therefore distinct from the mere existence of a vulnerability. A severe vulnerability can be difficult to exploit in one environment while a less obvious flaw may be highly practical under particular conditions.
Exploits are important to both offensive and defensive cybersecurity. Attackers use them to obtain initial access, escalate privileges, move laterally or compromise targeted systems. Security researchers use exploits to validate vulnerabilities, understand their consequences and develop fixes or mitigations. Penetration testers use authorised exploitation to determine whether theoretical weaknesses can actually be used against an organisation. Security vendors may develop detection signatures and behavioural protections based on exploit techniques.
Vulnerability-management programmes therefore need to consider not only vulnerability severity but also exposure, exploitability, available mitigations, attacker interest and the importance of the affected asset. A vulnerability that is publicly exploited in the wild can require faster remediation than an isolated flaw with no practical attack path.
Defending against exploitation involves reducing vulnerabilities and making successful exploitation harder. Secure coding practices, code review, fuzz testing, dependency management and security testing reduce the number of weaknesses introduced into software. Prompt patching addresses known vulnerabilities, while configuration hardening can remove unnecessary attack surfaces. Web application firewalls, endpoint protections, intrusion-prevention systems and network segmentation can provide additional layers, although they should not substitute for fixing vulnerable software. Least privilege limits what an attacker can achieve after exploitation. Sandboxing and application isolation can constrain compromised processes. Monitoring for exploitation indicators, abnormal process creation, unusual network activity and privilege escalation can help identify attacks that bypass preventive controls.
Exploits are often discussed together with vulnerability identifiers such as CVE records and severity frameworks, but these concepts are not interchangeable. A vulnerability record describes a known security weakness, while an exploit describes a way to take advantage of it. An exploit may exist privately, publicly as proof-of-concept code, or as an operational attack used against victims. Exploit availability can change the practical risk associated with a vulnerability over time.
A zero-day exploit is an exploit for a vulnerability that defenders or vendors did not have an effective fix for at the relevant time, although terminology can vary according to context. Understanding the distinction between vulnerability, exploit, exploitability, mitigation and patch status is essential for accurate security assessment because the existence of a flaw does not automatically mean that exploitation is trivial or inevitable.
