The term comes from the English "to exploit", meaning to take advantage of. Germany's Federal Office for Information Security (BSI) describes an exploit as a method or program code used to execute unintended commands or functions through a vulnerability. The distinction matters: the vulnerability is the flaw, the exploit is the tool, and the attack is its use. A vulnerability for which nobody has yet built an exploit is less urgent than one for which ready-made attack code is in circulation.
What types of exploits are there?
- Remote exploit: It works over the network without the attackers having prior access to the system. Especially dangerous for services reachable from the internet.
- Local exploit: It requires initial access and is often used to escalate restricted rights to administrator rights.
- Proof of concept (PoC): Evidence that a vulnerability can be exploited in practice. Security researchers publish such evidence to warn vendors and operators; attackers, however, also turn it into usable tools.
- Exploit kit: A ready-made software package that bundles several exploits and automates attacks, for example via manipulated websites.
- Zero-day exploit: It uses a vulnerability that is still unknown to the vendor or for which no update exists, see zero-day vulnerability.
How attackers use exploits
A common entry point is exploiting systems that are reachable from the internet. MITRE ATT&CK lists technique T1190 "Exploit Public-Facing Application" for this: web servers, databases, VPN gateways, or management interfaces are taken over through a software flaw or misconfiguration. The need for attention is high: according to the BSI situation report 2025, an average of 119 new vulnerabilities per day became known during the reporting period. At the same time, the BSI emphasizes that this number says nothing about how many of them are actually exploited.
In practice for SMEs and municipalities
Whether an exploit exists for a vulnerability, or whether it is already being exploited, is the most important criterion for the order of updates. The CISA KEV catalog lists vulnerabilities that are known to be exploited, and EPSS estimates the probability of exploitation in the next 30 days. For smaller organizations and municipalities, this means: update firewalls, VPN access, email servers, and web portals first as soon as an exploit becomes known.
Measures
- Patch quickly: Well-practiced patch management with an emergency path for critical updates shortens the window of opportunity for attackers.
- Keep the attack surface small: Make only necessary services reachable from the internet and harden systems consistently, see system hardening.
- Use interim measures: If no update is available yet, vendors often publish workarounds, such as disabling a feature.
- Detect exploitation: Endpoint detection and response notices suspicious behavior even if the exploit itself is unknown.
- Check after the update: If a system was vulnerable and reachable, clarify whether it has already been attacked.
How TOMORIS relates
GRID.patch rolls out updates to systems in agreed maintenance windows and in stages, and GRID.scout shows where vulnerable versions are running.