Log in Request a demo

Glossary

Proof-Of-Concept Exploit.

Also called PoC exploit, PoC, exploit PoC

In Short

A proof-of-concept exploit is code that shows a vulnerability can be exploited. CISA describes PoC as the code for a vulnerability that, when executed, would allow for exploitation. CISA also says that making a PoC public can increase the likelihood of an attacker exploiting the vulnerability.

Last updated October 23, 2026
Profile MapGlossary Term
  1. Also Called3other namesPoC exploit · PoC · exploit PoC
  2. Related Terms3linked entriesZero-day vulnerability · Exploit kit

What Is a Proof-of-Concept Exploit?

CISA says PoC is the code for a vulnerability that, when executed, would allow for exploitation. It is often shortened to PoC. A PoC is meant to show that a weakness is real and can be used.

Why Does a Public PoC Raise the Risk?

CISA says that making a PoC publicly available can increase the likelihood of an attacker exploiting the vulnerability in the wild. The same code that shows a bug is real can therefore also be picked up by someone else. CISA adds that the public availability of a PoC does not automatically indicate the vulnerability has been or will be exploited.

Is a PoC the Same as Active Exploitation?

No. In relation to its Known Exploited Vulnerabilities catalog, CISA lists scanning, security research of an exploit and proof of concept as events that do not count as active exploitation. CISA also says a publicly available PoC is not a requirement for a vulnerability to be included in the catalog. What matters for the catalog is evidence of exploitation in the wild.

What Should a Team Do When a PoC Appears?

The NCSC gives a rule for this case. If proof-of-concept code exists and exploitation could cause high harm, fix the flaw sooner than your usual timelines. Its guidance on responding to exploitation also gives a working order.

When a PoC for Your Software Appears
  1. Check whether you run itRescan known systems with an updated scanner, and confirm it has a detection for this flaw.
  2. Look beyond the asset listSearch for shadow IT, developer systems and contractor setups that run the software.
  3. Check if attackers can reach itConfirm the system is reachable from the internet, once you know you own it.
  4. Raise the priorityIf harm could be high, fix sooner than your usual timelines.
  5. Update with vendor adviceFollow the vendor advisory. Update non-critical systems first to test the process.
  6. Handle exploit code with careDo not run it to confirm a flaw until an expert has checked it for backdoors.

The NCSC warns that there is a long history of exploit code that instead attacks the person running it. For the wider process, read how to respond to actively exploited vulnerabilities.

Is a Proof-of-Concept Exploit the Same as a Zero-Day?

No. A zero-day vulnerability is a flaw unknown to the vendor. A PoC is code for a vulnerability and, in general, could be written for a flaw whether or not a patch exists. Related terms include exploit kit and known exploited vulnerabilities.

Sources

  • CISA: CISA defines PoC as code that would allow exploitation and says public PoC alone is not active exploitation.
  • UK NCSC: The NCSC advises not running released exploit code without expert assessment and prioritizing fixes where PoC exists.

Also Called.

  • NamePoC exploit
  • NamePoC
  • Nameexploit PoC

Questions.

  • What is a proof-of-concept exploit?

    CISA describes a proof of concept (PoC) as the code for a vulnerability that, when executed, would allow for exploitation. It is meant to show that a weakness is real and can be used.

  • Does a public PoC mean a vulnerability is being exploited?

    Not automatically. CISA says public availability of a PoC does not indicate a vulnerability has been or will be exploited, though it can increase the likelihood of an attacker exploiting it. For its KEV catalog, evidence of exploitation in the wild is what matters.

  • How should teams respond when a PoC is released?

    The NCSC says that if PoC code exists and successful exploitation could cause high harm, you should fix the vulnerability sooner than your usual timelines. Follow vendor advisories and apply updates.

  • Is it safe to run published exploit code?

    The NCSC says security teams might want to study it. They should not use it to confirm a vulnerability until an expert has checked it for backdoors or other malicious behavior. Some exploit code attacks the person running it.

In Our Research

  1. 1 Node.js Ecosystem Roundup: Node-RED Exploitation Reported, Cisco’s Brotli List and the 11 November Release November 2026
  2. 2 Five AG-UI Protocol CVEs: Two Are Fixed, Three Are Not November 2026
  3. 3 Langflow Critical Vulnerabilities: Why the Fix Target Is Now 1.13.0 October 2026
  4. 4 CVE-2026-98432: Ubuntu Kernel Status and Host Triage October 2026
  5. 5 Laravel Authentication Bypass: A Two-Line Fix in August, the Advisory in October October 2026
  6. 6 Node2Shell: Node.js Brotli RCE (CVE-2026-111497), Fixed Versions and How to Check October 2026

Keep Exploring.

Knowledge Hub
Article PHP2Shell Timeline: The First 60 Hours, In Data PHP2Shell timeline of the first 60 hours: Japan's PM post, a Sophos correction, notable X and dark web posts, and our own counts and… Open Article GitLab CVE-2026-110264: Am I Affected And What To Do In The Next Hour GitLab critical flaw CVE-2026-110264 (CVSS 10.0) can let an unauthenticated attacker run code. Check your version: fixed in 19.5.1 and backports. Open Glossary term Backdoor A backdoor is an undocumented way of gaining access to a computer system, and NIST says it is a potential security risk. Open

Browse The Library.