What is the difference between a vulnerability, an exploit, and a threat?
A vulnerability is a weakness in a system. An exploit is the technique or code that takes advantage of that weakness. A threat is the actor or event with the intent and capability to use it against you. Risk is what emerges when all three meet something valuable that you own and have not adequately protected.
The distinction is not pedantry — it determines what you can actually do. You can remediate a vulnerability. You can detect and block an exploit. You cannot remove a threat actor, only raise their cost.
Vendors and headlines blur the three constantly, which is how a proof-of-concept published on a research blog gets reported as an active attack campaign.
When you read an advisory, separate the claims: does a flaw exist, does working exploit code exist, and is anyone using it? Those three facts often arrive days or weeks apart, and the right response differs at each stage.
More on vulnerabilities