A proof-of-concept exploit is code that shows a vulnerability can be exploited. CISA describes PoC as the code for a vulnerability that, when executed, would allow for exploitation. CISA also says that making a PoC public can increase the likelihood of an attacker exploiting the vulnerability.
- Also Called3other namesPoC exploit · PoC · exploit PoC
- Related Terms3linked entriesZero-day vulnerability · Exploit kit
What is a proof-of-concept exploit?
CISA says PoC is the code for a vulnerability that, when executed, would allow for exploitation. It is often shortened to PoC. A PoC is meant to show that a weakness is real and can be used.
Why does a public PoC matter?
CISA says that making a PoC publicly available can increase the likelihood of an attacker exploiting the vulnerability in the wild. The same code that shows a bug is real can therefore also be picked up by someone else. CISA adds that the public availability of a PoC does not automatically indicate the vulnerability has been or will be exploited.
Is a PoC the same as active exploitation?
No. In relation to its Known Exploited Vulnerabilities catalog, CISA lists scanning, security research of an exploit and proof of concept as events that do not count as active exploitation. CISA also says a publicly available PoC is not a requirement for a vulnerability to be included in the catalog. What matters for the catalog is evidence of exploitation in the wild.
How should teams respond?
The NCSC says that if there is proof-of-concept code available for the vulnerability, and successful exploitation could cause a high level of harm to your organization, you should fix the vulnerability sooner than your usual timelines would require.
- Treat a public PoC as a reason to raise the priority of a fix when harm could be high, as the NCSC advises.
- Follow vendor advisories and apply updates.
- Be careful with released exploit code. The NCSC says security teams might want to study it, but should not use it to confirm a vulnerability without expert assessment that it does not contain backdoors or other malicious behavior.
- Remember the NCSC’s warning that there is a long history in the security world of exploit code that instead attacks the person running it.
Is a proof-of-concept exploit the same as a zero-day?
No. A zero-day vulnerability is a flaw unknown to the vendor. A PoC is code for a vulnerability and, in general, could be written for a flaw whether or not a patch exists. Related terms include exploit kit and known exploited vulnerabilities.
Sources
Also Called.
- NamePoC exploit
- NamePoC
- Nameexploit PoC
Questions.
-
What is a proof-of-concept exploit?
CISA describes a proof of concept (PoC) as the code for a vulnerability that, when executed, would allow for exploitation. It is meant to show that a weakness is real and can be used.
-
Does a public PoC mean a vulnerability is being exploited?
Not automatically. CISA says public availability of a PoC does not indicate a vulnerability has been or will be exploited, though it can increase the likelihood of an attacker exploiting it. For its KEV catalog, evidence of exploitation in the wild is what matters.
-
How should teams respond when a PoC is released?
The NCSC says that if PoC code exists and successful exploitation could cause high harm, you should fix the vulnerability sooner than your usual timelines. Follow vendor advisories and apply updates.
-
Is it safe to run published exploit code?
The NCSC says security teams might want to study it, but should not use it to confirm a vulnerability without expert assessment that it contains no backdoors or other malicious behavior. Some exploit code attacks the person running it.
In Our Research
- 1 Two NetScaler Zero-Days, One Wrong Assumption: Why Patching Does Not Close the Incident October 2026
- 2 XSS2Shell (CVE-2026-64638): WordPress Login Page Pre-Auth XSS to RCE Chain Explained August 2026
- 3 WP2Shell Technical Analysis: CVE-2026-63030 & CVE-2026-60137 WordPress Core RCE Chain July 2026
- 4 Why CVSS Scores Are Lying to Your Security Team (And What to Use Instead) July 2026
- 5 From Disclosure to Exploit: How Fast Are Threat Actors Weaponizing New CVEs? July 2026
- 6 Adobe Acrobat Reader DC RCE Vulnerability: Exploit Code Released February 2023