# WTF does "exploited in the wild" mean?

> Sarge says: Lab bugs are drills. This one is live fire.

- Term: Exploited in the wild
- Also called: in the wild; actively exploited; active exploitation; known exploited
- Section: Under attack
- Web page: https://codemarine.ai/learn/exploited-in-the-wild/

## Short version

Exploited in the wild means attackers are using a flaw on real targets, not just researchers in a lab.

## The briefing

- **Before:** Someone reports a bug, a researcher may build a proof of concept to show it is real and that can be the end of it.
- **In the wild:** The next step up: real attackers, real systems, real damage.
- **Vulnerability:** The hole in the wall.
- **Exploit:** The tool that goes through it.
- **Exploitation in the wild:** Someone using that tool on live targets. Headlines mash these three together, so keep them apart.
- **CISA's hard line:** For its KEV list it wants reliable evidence of active exploitation. Scanning, security research and a proof of concept do not count.
- **No public exploit needed:** A public proof of concept is not required either, because attackers do not publish their homework.
- **CVSS or this:** CVSS tells you how bad a bug could be. This tells you the shooting has started.
- **Order of march:** A lower-scored bug under live attack can deserve your morning more than a critical one nobody is using.
- **A patch is not an eviction:** It closes the hole. It does not remove anyone already inside. BOD 26-04 pairs some fixes for federal agencies with a forensic triage to assess whether the system is compromised.

## In the Threat Brief this looks like

> CVE-YYYY-NNNN in ExampleApp is being actively exploited in the wild.

This is not a lab result. If you run the affected version, it just became your next job.

Example only. The product, versions and names are made up.

## What to do

- If you run the affected version, treat it as urgent.
- Fix it first.
- Then check whether you were hit before the fix landed.

## Official sources

- [CISA: Reducing the Significant Risk of Known Exploited Vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog/reducing-significant-risk-known-exploited-vulnerabilities)
- [CISA: BOD 26-04, Prioritizing Security Updates Based on Risk](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk)
- [FIRST: Exploit Prediction Scoring System (EPSS)](https://www.first.org/epss/)

## Related

- [CISA KEV](https://codemarine.ai/learn/cisa-kev.md)
- [Zero-day](https://codemarine.ai/learn/zero-day.md)
- [Indicators of compromise](https://codemarine.ai/learn/indicators-of-compromise.md)