Security & privacy

Vulnerability, Exploit & Patch

The short version

A vulnerability is a security weakness; an exploit is a way to use it; a patch is a software fix.

A weak lock, a way in, and a repair

A faulty lock is a vulnerability. A way to open it without a key is an exploit. Repairing it is like applying a patch to software: an update that fixes the weakness.

A CVE number is a public label for a known software weakness.

How urgent is the fix?

A flaw exposed to the internet may need faster action than the same flaw in a system few people can reach. Teams also consider what data or services it could affect.