An exploit is a piece of code, a command sequence, or a technique that takes advantage of a specific vulnerability to make software or hardware behave in a way its designers never intended, often to gain unauthorized access, escalate privileges, or crash a system. The vulnerability is the flaw; the exploit is the act of weaponizing it.
Not every vulnerability has a working exploit, and that distinction drives real prioritization: a flaw with public, reliable exploit code deserves patching long before a theoretical one. A zero-day exploit is especially dangerous because it targets a vulnerability the vendor does not yet know about, leaving no patch available. Penetration testers use exploits deliberately, often through frameworks like Metasploit, to prove that a weakness is genuinely reachable rather than merely listed by a scanner. That proof is the point, because demonstrating impact convinces leadership far better than a raw list of findings.
Why does the term exploit matter for the CISSP exam?
It shows up most in Domain 6, Security Assessment and Testing. Candidates should separate threats, vulnerabilities, and exploits, understand zero-day risk, and know how exploitation fits into penetration testing and vulnerability management.