Active Exploitation — Glossary

The longer version

It means that someone is already using the flaw, not that it could be. Evidence comes from vendor and researcher reports, honeypots, incident response cases and government lists such as the KEV catalog.

It changes the priority completely. A flaw with a public exploit and a few attackers behind it is a different thing from a flaw that is merely severe on paper. When active exploitation is confirmed, the time to fix is measured in hours and days, and defenders also need to check whether they were already hit before they patched.

MOVEit Transfer in 2023 is an example: the flaw was being used in real data-theft attacks before most customers knew it existed.

Keep a faster path for flaws that are being exploited, patch or mitigate first, and look in your logs for signs of earlier compromise, because a patch does not remove what an attacker has already done.

Where we use “Active Exploitation”

CybersecurityPatch by Exploitation, Not CVSS
Sorting a patch queue by CVSS puts actively exploited flaws behind thousands that nobody is using. Four yes-or-no questions adapted from CISA's new directive give a small team a faster order.
Nov 1, 2026Key term
CybersecurityCitrix and Ivanti Edge Zero-Days: What to Patch Now
Citrix NetScaler and Ivanti Connect Secure were exploited before fixes existed, and NetScaler's 4 October fix builds are still affected by a later SAML flaw on appliances acting as an identity provider. Here are the builds to move to by 6 November and how to check for compromise.
Nov 1, 2026Key term
CybersecurityMicrosoft's Record Patch Tuesday: What More Than 1,400 CVEs Actually Mean
Microsoft's October 2026 Patch Tuesday listed about 1,413 CVEs, roughly eight times the previous monthly record. Here is what the count measures, who found the flaws, and how to turn the list into a patch order.
Nov 1, 2026Key term
CybersecurityCISA Adds Exploited GitLab and Cisco Flaws
Two exploited flaws hit CISA's KEV catalog on 29 October, but upgrading GitLab to the 12 October builds still leaves a second CVSS 10.0 flaw open. Here's what to patch, and in what order.
Nov 1, 2026Key term
CybersecurityGlobalProtect CVE-2026-0257 and Ransomware
Palo Alto's GlobalProtect flaw CVE-2026-0257 went from an advisory on 13 May to ransomware intrusions by June. This timeline separates what the documents show from what sources only report or claim.
Nov 1, 2026Key term
CybersecurityExploits Overtake Stolen Passwords
Verizon's 2026 DBIR puts exploitation first at 31%, ahead of credential abuse at 13%. The rise is real, but a new category and a changed taxonomy make the gap look wider than it is.
Nov 1, 2026Key term

The longer version

Where we use “Active Exploitation”

Get the Core in your inbox.