Exploited vulnerability
A software flaw that attackers are actually using in real attacks, not just one that could be used in theory.
Thousands of software flaws are published every year. Most are never used by attackers. A small fraction, a few hundred a year, are confirmed as exploited, meaning someone has seen them used against real systems.
Security people sometimes call an exploited flaw that already has a fix an "n-day", as opposed to a zero-day, which had no fix when attacks began.
Patch Sonar lists only exploited flaws: those on CISA's catalog, or those the vendor itself says are being exploited.
Why it matters to you: You can't patch everything at once. Exploited flaws are the ones to fix first, because they're the ones attackers are already using.
Related terms
- Zero-dayA security hole that attackers found and used before the software's maker had a fix ready.
- CISA's Known Exploited Vulnerabilities catalog (KEV)The U.S. government's official list of software flaws with confirmed real-world attacks, each with a deadline for federal agencies to fix it.
- EPSS (exploit prediction score)A daily estimate, from 0% to 100%, of how likely a flaw is to be exploited in the next 30 days.