Actively exploited means a vulnerability is already being used by attackers in real-world attacks, not just discussed in a lab or reported as a theoretical risk. It often appears in threat advisories when defenders have evidence of exploit attempts, successful intrusions, or malware making use of the flaw.
This status matters because it changes patching from routine maintenance into urgent risk reduction. An actively exploited bug can give attackers a working entry point before organizations have time to upgrade, segment systems, or block exposure. In practice, defenders respond by applying patches quickly, restricting access to affected services, increasing monitoring, and looking for signs of compromise. Security teams also use the label to prioritize alerts: a known vulnerability that is actively exploited deserves faster action than one that has only been publicly disclosed.