An actively exploited vulnerability is a software or hardware flaw that attackers are using in real-world operations, not just one that exists on paper or in a lab. The exploitation may target internet-facing services, endpoints, or supply-chain components, and it can involve anything from remote code execution to privilege escalation or data theft.
This matters because an exploited flaw is immediately higher risk than a dormant one. Defenders must treat it as a live threat: validate the activity, preserve logs and evidence, contain affected systems, and prioritize patching or mitigation. In practice, security teams look for indicators such as suspicious traffic, unexpected process behavior, exploitation patterns in telemetry, and proof that an exploit works against vulnerable versions. For organizations, knowing when a vulnerability is actively exploited can also trigger internal escalation, incident-response workflow, and reporting obligations.