This knowledge base article will give insight into:
- The definition of exploitability and the factors that affect a vulnerability’s exploitability
- The definition of exploit availability
- What the Known Exploited Vulnerability (KEV) catalog is
- Exploit availability’s importance and challenges that security teams face
Exploitability refers to the potential or likelihood that threat actors can use a vulnerability to compromise systems, applications, or networks. When assessing exploitability, security professionals consider whether attackers can easily use the vulnerability to achieve their objectives, accounting for factors like:
- Complexity of system architecture: Complex systems require more advanced attacker expertise, influencing ease of exploitation.
- Existence of Exploit Code: Verified and popular exploit code, especially if linked extensively in common repositories, increases the chances of exploitation.
- Threat Actor Skill Level: The expert status of threat actors can determine how vulnerabilities are exploited.
- Exploit Timelines: The median time from disclosure to exploitation may vary, affected by exploit difficulty and value.
- Network Tools and Automated Agents: These tools can enhance an exploit’s spread, increasing vulnerability scores.
- Potential Impact: The harm attackers can cause if they exploit a vulnerability, such as remote code execution or zero-day exploitation.
The Common Vulnerability Scoring System (CVSS), supported by the National Vulnerability Database (NVD), uses exploitability as one of the qualitative measures for vulnerability severity.
Vulnerability and patch management teams use exploitability as one way to help them prioritize their remediation activities.
Exploit Availability refers to the existence and accessibility of exploit code for identified vulnerabilities. Within CVSS 4.0, the Threat Metrics incorporate the following publicly available information when when adjusting a vulnerability’s severity:
- Availability of proof-of-concept code: Publicly available exploit code with sufficient technical details that indicate attackers may be able to exploit the vulnerability, even without knowledge of reported attempts or publicly available solutions to simplify attempts.
- Active exploitation: Reports of attempted or successful attacks against the vulnerability with solutions that simplify the exploit attempts, like publicly or privately available exploit toolkits.
Understanding exploit availability helps prioritize remediation efforts, especially when dealing with zero-day and n-day vulnerabilities. Exploit availability can fall into three different categories:
- Publicly available: Publicly accessible exploit
- Commercially available: Exploit available for purchase
- Allegedly privately available: Claims or rumors that an exploit is available privately
The Known Exploited Vulnerability (KEV) Catalog lists vulnerabilities that have assigned Common Vulnerabilities and Exposures (CVE) IDs with confirmed evidence of active exploitation by threat actors.
The KEV Catalog’s key feature include:
- CVE Assignment: Identifying and tracking CVE IDs provided by the CVE Program which is sponsored by CISA and operated by The MITRE Corporation.
- Active Exploitation: Each entry in the catalog has reliable evidence of being exploited in the wild, highlighting n-day vulnerabilities and zero-day exploitation.
- Remediation Prioritization: The catalog prioritizes those vulnerabilities that have clear remediation actions, such as updates provided by software vendors.
Security, vulnerability management, and patch management teams can use the KEV catalog to:
- Prioritize vulnerability management activities
- Focus remediation and monitoring on actively exploited vulnerabilities
- Optimize patching strategies or compensating control implementations to mitigate potential impacts
Exploit availability indicates whether exploit code for a specific vulnerability is accessible in public, commercial, or private formats, impacting the likelihood that threat actors will target the vulnerability to achieve their objectives.
Some benefits of using Exploit Availability as part of prioritizing vulnerability remediation include:
- Increased likelihood of exploitation: While the existence of exploit code can increase the chances of successful exploitation, many vulnerabilities with exploit code remain unused so this should be only one factor used when prioritizing activities.
- Early threat indicator: The availability of exploits provides insight into threat actor thought processes and evolving attack methodologies, so security teams can proactively fortify defenses.
- Vulnerability Management: While exploit availability aids in assessing the security posture and prioritizing remediation, vulnerability and patch management teams should prioritize active exploitation targeting specific entities.
When determining the potential impact that an available exploit can have, security teams should also consider:
- Attackers are more likely to use a publicly available exploit, making these vulnerabilities the highest priority.
- Attackers often use commercial exploits for targeted attacks, so additional threat intelligence surrounding real-world attacks using the vulnerability can help understand whether the organization is more or less likely to be a victim.
- Attackers often have limited access to and use of privately available exploits, influencing the risk and harm to individual organizations.
Security, vulnerability management, and patch management teams struggle to appropriately incorporate Exploit Availability into their vulnerability prioritization strategies.
While the KEV Catalog provides information about known exploits, information about proof-of-concept, commercially available, and privately available exploits is difficult to find. The information is often dispersed across different threat actor communication channels, making it more difficult to consolidate all information about available exploits.
Many security teams already struggle with the cybersecurity skills gap, making it more difficult to implement threat research. Without people who can monitor cybercriminal communications, these teams have no way to collect information unless it appears on the clear web.
When security teams have the people who can monitor these communications, the process is time-consuming. Often, organizations need to dedicate a full time security analyst to infiltrate these communications channels or limit their research which leads to information gaps. These time-consuming processes mean that security teams often only receive information about exploit availability after threat actors have successfully used the vulnerability in an attack against the organization or someone else.
While some security teams have dark web monitoring tools, these technologies often collect a wide array of threat information. Even when they integrate into the organization’s security information and event management (SIEM) solution, they may collect comprehensive information focused on vulnerability exploits.
With VulnCheck organizations gain the insights they need into exploit availability so they can appropriately prioritize remediation activities. VulnCheck is an average of 14 days faster than the NVD for reporting vulnerabilities and provides the industry’s largest collection of exploit availability threat intelligence, and over 1 month faster vs CISA KEV. Our platform provides complete exploitation timelines covering vulnerability discovery and publication, discovery of exploit availability and exploitation, and vulnerability remediation publication.
