Exploit
What is Exploit?
A piece of software, data, or sequence of commands that takes advantage of a vulnerability in a computer system, application, or network to cause unintended behaviour such as unauthorised access or code execution.
Terms that appear alongside exploit
Each of these is named in at least one of the same controls as exploit. The number is how many controls name both.
- integrity 3 shared controls
- mitre 2 shared controls
- vulnerability 2 shared controls
- audit 2 shared controls
- profiling 2 shared controls
- risk analysis 2 shared controls
Frameworks that govern exploit
What the standards actually require on exploit
Requirements naming exploit across 6 standards, quoted from the control text.
The likelihood of system compromise is frequently assessed when working exploits exist for unmitigated vulnerabilities.
ISM-1921 · Assessing compromise likelihood for exploited vulnerabilities →Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.
acsc-essential-eight::E8-PATCHOS-ISM-1879 · Patch operating systems (ISM-1879): Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist →Threats that abuse the procedures a module uses to realign its own parameters (for example detector timing or shot-noise calibration), where an adversary on the quantum channel can steer the adjustment to induce a detection-probability mismatch or a wrong cali...
iso-iec-23837-2023::1-7.5.4 · Part 1, 7.5.4 Threats exploiting parameter adjustment vulnerabilities →An early warning of the actively exploited vulnerability must go in without undue delay and within 24 hours of the manufacturer becoming aware of it, naming, where applicable, the Member States where the manufacturer knows the product has been made available.
eu-cyber-resilience-act::Art. 14(2)(a) · Early warning within 24 hours of awareness of an exploited vulnerability →Where POS POI terminals at a merchant or payment acceptance site still use SSL or early TLS, the entity must verify that no known exploit of those protocols works against the devices.
pci-dss-4-0::A2.1.1 · A2.1.1 Confirm SSL/early TLS POS POI devices resist known exploits →Assess likelihood for each threat and vulnerability pairing using a defined scale, considering threat source capability, intent, and historical occurrence.
RA-LIKELIHOOD · Risk Analysis: Determine the Likelihood of a Threat Exploiting a Vulnerability →Questions people ask about exploit
What is Exploit?
Why is Exploit important for compliance?
Which compliance frameworks address Exploit?
Where can I learn more about Exploit?
See how Exploit applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.