Exploitable

Exploitable is an adjective used to describe a system, component, or configuration that contains one or more vulnerabilities or weaknesses that could be leveraged by an attacker to compromise confidentiality, integrity, or availability. In cybersecurity, an exploitable flaw may enable unauthorized access, privilege escalation, remote code execution, data loss or exfiltration, or service disruption.

Exploitability depends on several factors, including the presence and severity of vulnerabilities, the size of the attack surface, the access required to exploit the flaw, and the attacker’s capabilities. Standardized measures such as the Common Vulnerability Scoring System (CVSS) include an exploitability subscore to reflect how easy or difficult an attacker would find a given vulnerability to exploit. Exploitability can change over time as new exploits become available, system configurations change, or patches and mitigations are applied. It is also influenced by environmental factors such as network exposure and user behavior.

Common sources of exploitable conditions include software defects such as memory corruption or input validation flaws, weak or broken authentication, insecure defaults, misconfigurations, unpatched components, and exposed administrative interfaces or services. Exploitability is context-dependent: a flaw that is easy to exploit in one environment may be harder or impractical in another due to security controls or limited access.

Mitigation typically involves a defense-in-depth approach: timely patching and vulnerability management, secure coding practices, strict access controls and least privilege, robust authentication, input validation, network segmentation, and continuous monitoring. Regular security testing and incident response planning help reduce overall exploitability by detecting and addressing weaknesses before they can be leveraged.