What is an exploit? Definition, exploit code maturity, and how KEV uses the word

An exploit is a program, script or sequence of commands that takes advantage of a flaw in software, firmware or hardware to make a system behave in a way its design never intended, usually to gain access, run code or cause a disruption. NIST's own glossary calls this exploit code: a program that lets attackers automatically break into a system.

Exploit, vulnerability and exploit code are three different things

A vulnerability is the flaw itself: a weakness in code, configuration or design that should not be there. An exploit, or exploit code, is the separate thing that takes advantage of that flaw — a crafted file, a line of shell input, or a standalone tool built to run the attack end to end. The distinction matters because a CVE can exist, and even carry a severity score, for years with no working exploit ever published against it, or with one that only works under narrow conditions.

Not every exploit is equally dangerous to defend against. The same flaw can go from "theoretical" to "a tool anyone can run" as researchers, criminals or both do more work on it, and that change is exactly what a patch desk needs to track.

How mature is the exploit code, in practice

FIRST.org's Common Vulnerability Scoring System (CVSS) grades this directly, in a metric it calls Exploit Code Maturity. Four levels, from its version 3.1 specification:

• Unproven — no exploit code is available, or an exploit is only theoretical.
• Proof-of-Concept — exploit code exists, but it is not practical against most systems without real extra work from a skilled attacker.
• Functional — exploit code works in most situations where the vulnerability exists.
• High — functional, self-running exploit code exists (or no exploit is even needed, such as a flaw triggered by hand), and reliable, easy-to-use automated tools already circulate.

A "High" rating is the point at which a network-connected system can expect automated scanning or exploitation attempts, not just a determined individual attacker.

Where CISA draws the line: "exploited," not "exploitable"

CISA's Known Exploited Vulnerabilities (KEV) catalog does not list every CVE with available exploit code. It lists only vulnerabilities CISA has reliable evidence attackers have already used in the wild, with a clear remediation action available.

That is a narrower claim than "an exploit exists for this." A flaw can sit in the National Vulnerability Database for years, with published proof-of-concept code, before CISA has evidence of real-world use. CVE-2015-3306, a ProFTPD flaw published in 2015, did not reach KEV until October 2026 — a gap Daily CISO's own exploit lag tracker measures for every current KEV entry.

Where it appears on Daily CISO

Must-patch and the KEV catalog tracker both show which flaws CISA has confirmed exploited. Exploit lag measures how long an exploit was theoretically possible before that confirmation; the zero-day entry covers the narrower case of exploitation before any fix exists at all.

Related terms

Zero-day vulnerability, CVE, CVSS, Known Exploited Vulnerabilities (KEV) catalog, EPSS and exploit lag.