Skip to content
Knowledge Hub/Article
Article

What Is an Exploit? Zero-Days, Exploit Kits and How to Defend

An exploit is code or a method that uses a software vulnerability to gain unauthorized access. Types, zero-days, the attack chain and the defenses that work.

Oğuzhan Gerçek··5 min read
What Is an Exploit? Zero-Days, Exploit Kits and How to Defend

Short answer: An exploit is code, data or a sequence of commands that uses a vulnerability in software or hardware to make a system do something it should not: unauthorized access, privilege escalation, remote code execution, a crash. The vulnerability is the gap in the door; the exploit is the tool that goes through it. Exploits used in the wild before a patch is available are called zero-days; by Google's count, 90 zero-days were exploited in the wild in 2025. Most of the defense rests on two things: applying patches in time, and layers that limit the damage even when an exploit works (least privilege, segmentation, EDR).

What is an exploit?

Behind every exploit is a vulnerability: a memory management bug, unvalidated input, a misconfigured permission, a default password. The exploit is the specially crafted input that triggers the bug; it can be a fragment of SQL typed into a web form, code embedded in a PDF, a malformed header in a network packet, or simply a few requests sent in the right order. Public vulnerabilities are referred to by CVE numbers; the existence of an exploit is what really sets a vulnerability's severity, because a theoretical hole and a copy-and-paste attack tool are not the same risk.

An exploit is rarely the goal on its own. Its place in the attack chain is usually the first step or the privilege-escalation step in the middle; afterwards malware is installed, persistence is established, the attacker moves laterally through the network, and in most incidents it ends with ransomware.

Types of exploit

  • Remote exploit: Works over the network without prior access to the system; the most dangerous class. Internet-facing VPN appliances, firewalls, mail servers and web applications are typical targets.
  • Local exploit: Used by an attacker who already has an account on the system to escalate privileges.
  • Client-side exploit: Targets the browser or office software through a document the user opens, a link they click or a page they visit; it arrives together with phishing.
  • Web exploits: Use application-layer flaws such as SQL injection and XSS.
  • Zero-day exploit: Used in the wild before a patch has been published. According to Google Threat Intelligence Group's March 2026 report, 90 zero-days were exploited in the wild in 2025 (78 in 2024); 43 of them, 48 percent, were in enterprise software and appliances, and about half of those enterprise zero-days targeted security and network appliances.
  • N-day exploit: Targets vulnerabilities whose patch exists but has not been applied. Most attacks happen here, because the gap between patch release and patch deployment is the attacker's most productive window. Our checklist for the PHP2Shell flaws of October 2026 gives the steps for closing that window.

Exploit kits and proof of concept (PoC)

An exploit kit is an attack package planted on compromised websites that automatically tries browser and plugin flaws; it scans the visitor's system, picks a suitable exploit and downloads the payload. A proof of concept (PoC) is sample code showing that a vulnerability can be exploited; researchers publish it, defenders use it for testing, and attackers weaponize it. Once a PoC is public for a vulnerability, the time to patch drops from days to hours.

How are exploits detected?

  • Vulnerability scanning: Systems are scanned regularly for known CVEs, and the ones exploited in the wild are prioritized with lists such as CISA's Known Exploited Vulnerabilities catalog. The method is on the vulnerability scanning page.
  • Penetration testing: Tests in a controlled way whether a vulnerability is really exploitable; details in the penetration testing article.
  • Endpoint detection (EDR): Catches the behavior an exploit produces when it runs (an unexpected process, memory injection, a permission change); see EDR and XDR.
  • Logs and SIEM: Failed and unusual requests on internet-facing devices are watched with SIEM rules.

How to defend against exploits

  1. Patch management: The single most effective measure. For internet-facing systems the patch window should be measured in days, for vulnerabilities exploited in the wild in hours; the regime is in the patch management article.
  2. Shrinking the attack surface: Unneeded services are switched off, management interfaces are not exposed to the internet, and an inventory of internet-facing devices is kept.
  3. Least privilege: Even when an exploit works, the account it captures should have limited rights; administrator rights are kept separate with PAM.
  4. Network segmentation: One server falling should not mean the whole network falls; the method is in the network security article.
  5. Application-layer protection: A WAF in front of internet-facing applications; on the client side, up-to-date browsers and office software, and restrictions on macros and scripts.
  6. EDR and monitoring: When prevention fails, detection and response time decide the size of the damage.
  7. Backup and recovery: When the exploit chain ends in ransomware, the only way out is an immutable backup and a tested recovery plan.

Frequently asked questions

What does exploit mean? Code, data or a method that uses a vulnerability to make a system do something unauthorized. The vulnerability is the hole, the exploit is the tool that goes through it.

What is the difference between a vulnerability and an exploit? A vulnerability is a bug or weakness in software; an exploit is code that actually uses it. Not every vulnerability has an exploit; a vulnerability with an exploit needs an urgent patch.

What does zero-day mean? A vulnerability exploited in the wild before its patch is published, and the exploit written for it. By Google's count there were 90 in 2025.

What is an exploit kit? An attack package planted on compromised websites that automatically tries browser and plugin flaws and downloads malware.

Does antivirus catch exploits? It can catch known exploit signatures; zero-days and in-memory techniques need behavior-based EDR. The real protection is patching and least privilege.

Is using an exploit a crime? In Türkiye, entering an information system without authorization and remaining there is an offense under Article 243 and following of the Turkish Penal Code; penetration tests are done only with written authorization and a scope agreement.

Sources