---
title: "Exploit"
canonical: https://trickest.com/glossary/exploit
description: "An exploit is code or a technique that abuses a specific vulnerability to make a target behave in a way its operators never intended, such as running attacker commands or leaking data."
---

# Exploit

An exploit turns a vulnerability from a theoretical weakness into a working attack. It is the code or sequence of steps that abuses a flaw to force unintended behavior: executing attacker commands, bypassing authentication, reading memory it should not reach, or crashing a service. A vulnerability describes the bug; the exploit is the part that takes advantage of it.

Exploits range widely in maturity. Some exist only as a [proof-of-concept](/glossary/proof-of-concept) that demonstrates the flaw is real, while others are reliable, weaponized payloads packaged into frameworks for repeatable use. The Log4Shell flaw (CVE-2021-44228) moved from disclosure to public, reliable exploits within days, which is why exploit availability drives prioritization more than a severity score alone.

For offensive work, knowing an exploit exists for a given [CVE](/glossary/cve) changes the math. A flaw with a public exploit is far more likely to be hit, and a [zero-day](/glossary/zero-day) with a private exploit is the hardest case to defend against. Many exploits chain into [privilege escalation](/glossary/privilege-escalation) to convert initial access into full control.

In a Trickest workflow, you enrich scan findings with exploit availability so triage promotes the assets where a usable exploit already exists.

---
_Markdown source of https://trickest.com/glossary/exploit._