WTF does "exploited in the wild" mean?
Short version
Exploited in the wild means attackers are using a flaw on real targets, not just researchers in a lab.
The briefing
- Before
- Someone reports a bug, a researcher may build a proof of concept to show it is real and that can be the end of it.
- In the wild
- The next step up: real attackers, real systems, real damage.
- Vulnerability
- The hole in the wall.
- Exploit
- The tool that goes through it.
- Exploitation in the wild
- Someone using that tool on live targets. Headlines mash these three together, so keep them apart.
- CISA's hard line
- For its KEV list it wants reliable evidence of active exploitation. Scanning, security research and a proof of concept do not count.
- No public exploit needed
- A public proof of concept is not required either, because attackers do not publish their homework.
- CVSS or this
- CVSS tells you how bad a bug could be. This tells you the shooting has started.
- Order of march
- A lower-scored bug under live attack can deserve your morning more than a critical one nobody is using.
- A patch is not an eviction
- It closes the hole. It does not remove anyone already inside. BOD 26-04 pairs some fixes for federal agencies with a forensic triage to assess whether the system is compromised.
In the Threat Brief this looks like:
CVE-YYYY-NNNN in ExampleApp is being actively exploited in the wild.
This is not a lab result. If you run the affected version, it just became your next job.
Example only. The product, versions and names are made up.
What to do
- If you run the affected version, treat it as urgent.
- Fix it first.
- Then check whether you were hit before the fix landed.