A vulnerability is a weakness; an exploit is what abuses it. A vulnerability is a flaw in software, hardware, configuration, or process that could let someone violate a system's security. It exists whether or not anyone ever notices it. An exploit is the concrete code, data, or sequence of steps that actually takes advantage of that flaw, and the act of running it is exploitation. An unlocked door is the vulnerability, knowing to try the handle is the exploit, and walking through is the exploitation.
Three layers everyday speech blurs together#
People say "a vulnerability" to mean many different things. Pulling the idea apart into three layers makes it clear what a bug report, a patch, or an attack tool is really describing.
| Layer | What it is | Example |
|---|---|---|
| Weakness | A general flaw pattern that keeps recurring | A program that trusts input it never checks |
| Vulnerability | That pattern present in a specific product | A particular login form that passes raw input to a database |
| Exploit | The working technique against that instance | A crafted input string that makes the form return every user's password |
A weakness is a category of mistake. A vulnerability is one real instance of it. An exploit is proof that the instance can be abused.
The life of a flaw, from introduction to fix#
Most vulnerabilities follow the same arc. Where an attacker enters this timeline decides how dangerous the flaw is.
- Introduced. A coding error, a weak default, or a misconfiguration enters the system, often unnoticed for years.
- Discovered. A researcher, a vendor, or an attacker finds it. Who finds it first matters enormously.
- Disclosed. The flaw is reported, usually to the vendor first under coordinated disclosure, so a fix can be prepared before details go public.
- Patched. The vendor ships a correction.
- Remediated. Every affected operator actually installs that patch, which can take weeks or never happen at all.
The zero-day window#
A zero-day is a vulnerability that attackers can use before a patch exists, so defenders have had zero days to prepare. The most dangerous span is the gap between steps 2 and 4 above: a flaw is known to at least one attacker but has no available fix. Even after a patch ships, a second window stays open between steps 4 and 5, because unpatched systems remain exploitable long after the correction is released. This is why patch speed is treated as a core security metric rather than routine maintenance.
Naming flaws so everyone means the same thing#
Two public catalogs keep the industry speaking a common language. CVE (Common Vulnerabilities and Exposures) assigns a unique identifier to each specific publicly known vulnerability, so a single flaw has one name everywhere. CWE (Common Weakness Enumeration) classifies the underlying weakness types, the recurring patterns from the first table. A CVE entry usually points to the CWE category it belongs to, linking the one instance back to the general mistake, though some records leave that classification undetermined.
Where this sits among the fundamentals#
A vulnerability becomes a risk when it lives on something worth protecting and something can reach it, whether a deliberate attacker or an accident such as malformed input or a mistaken setting that trips the flaw. It is part of the assets and attack surface you expose, exploitation is what threats and threat actors attempt, a successful exploit breaks one or more goals of the CIA triad, and controls and countermeasures exist to close the flaw or blunt its impact.