The Vulnerabilities Threat Actors Actually Exploit
Attackers do not exploit CVEs at random. Cross-referencing actor profiles with their known exploited vulnerabilities reveals clear patterns you can use to prioritize patching.
Most CVEs die unexploited
Over 40,000 CVEs were published in 2024 alone. The number that saw confirmed exploitation in the wild is a small fraction of that: CISA's Known Exploited Vulnerabilities catalog, which spans decades of activity, contains around 1,400 entries. Even generous estimates put real-world exploitation at a few percent of published CVEs.
This is the single most useful fact in vulnerability management, and most programs ignore it. Attackers are not working through the NVD alphabetically. They are economically rational: they weaponize the small set of bugs that offer remote access, broad deployment, and weak monitoring at the point of exploitation. If you know which bugs those tend to be, and which actors are using them, your patch queue stops being a lottery.
The bug classes that get weaponized
Cross-reference threat actor profiles with their linked CVEs and the same categories appear again and again. On actors.mlab.sh, where actor profiles are linked to the CVEs they are known to exploit, the concentration is hard to miss: a handful of vulnerability classes account for most of the actor-to-CVE edges.
Edge devices and remote access infrastructure
VPN concentrators, firewalls, load balancers, mail gateways. These are the crown jewels of initial access: internet-facing by design, positioned at the trust boundary, rarely running EDR, and often patched on a slower cycle than servers because "it is the security appliance."
Citrix Bleed (CVE-2023-4966) is the archetype. A memory over-read in NetScaler ADC and Gateway leaked session tokens, letting attackers hijack authenticated sessions and walk straight past MFA. Within weeks of disclosure it was in use by LockBit affiliates and multiple espionage-linked groups, and it stayed productive for months because appliances do not patch themselves and hijacked sessions survived the patch unless terminated.
The same story repeats across Fortinet, Ivanti, Pulse Secure, Palo Alto, and Cisco ASA CVEs. If a product's job is to sit on the internet and terminate remote access, assume every serious bug in it will be exploited.
Managed file transfer and other data concentrators
MOVEit Transfer (CVE-2023-34362) showed how well a single bug class can pay. The Cl0p group exploited a SQL injection in MOVEit as a zero-day over a holiday weekend in May 2023, mass-harvesting data from more than 2,500 organizations without deploying ransomware at all. Pure exfiltration, then extortion. Cl0p had run the identical play against Accellion FTA and GoAnywhere MFT before it.
File transfer systems are attractive for the same reason banks are: that is where the data already is. One exploit, thousands of victims, no lateral movement required.
Auth bypass and ubiquitous libraries
Authentication bypasses turn an exposed admin panel into an open door, which is why they get weaponized fast even at moderate CVSS scores. And ubiquitous libraries create one-exploit-fits-all opportunities: Log4Shell (CVE-2021-44228) was exploitable across thousands of unrelated products because they all embedded the same logging library. Botnets, cryptominers, ransomware crews, and state-linked groups were all exploiting it within days, and it remains in active use years later against unpatched stragglers.
| Bug class | Why actors love it | Canonical example |
|---|---|---|
| Edge device RCE / session theft | Internet-facing, no EDR, bypasses MFA | Citrix Bleed (CVE-2023-4966) |
| File transfer injection | Data already concentrated, mass exploitation | MOVEit (CVE-2023-34362) |
| Ubiquitous library RCE | One exploit, thousands of products | Log4Shell (CVE-2021-44228) |
| Auth bypass on exposed panels | Cheap access, low skill floor | Recurring across VPN and MFT products |
Weaponization is fast, and getting faster
The comfortable old assumption was a grace period: disclosure, then weeks before working exploits circulated. That window has collapsed for the classes above.
- Zero-day first, patch later is now routine for high-value targets. MOVEit was exploited before anyone outside Progress knew the bug existed. The same has been true of multiple recent Ivanti and Barracuda campaigns.
- N-day exploitation within days is standard once a patch ships, because the patch itself is a roadmap. Researchers and attackers alike diff the fix, and public proof-of-concept code for edge device CVEs frequently appears within a week of disclosure. Mass scanning for the vulnerable version starts within hours of a PoC.
- Long tails last years. Exploitation does not stop when your news feed moves on. Log4Shell exploitation attempts remain background radiation on the internet today. Actors keep old reliable exploits in rotation because unpatched systems keep existing.
The practical consequence: for internet-facing systems in the hot categories, a 30-day patch SLA is a decision to be exploited. The realistic window is 24 to 72 hours, and for anything already on KEV, faster.
Different actors, same CVEs
One counterintuitive finding from actor-CVE mapping: the divide between "sophisticated APT" and "commodity ransomware" barely exists at the initial access layer. Espionage groups, ransomware affiliates, and initial access brokers routinely exploit the same edge device CVEs, sometimes in the same month. Volt Typhoon and LockBit affiliates do not share objectives, but they read the same advisories.
What differs is what happens after access. Which means the actor profile matters less for whether to patch fast (almost everyone exploits the same doors) and more for what to hunt for if you were exposed during the vulnerable window: webshells and living-off-the-land persistence for espionage-oriented actors, credential theft and rapid lateral movement for ransomware crews.
This is where linking your vulnerability data to actor intelligence earns its keep. Looking up a CVE on vuln.mlab.sh gives you CVSS, EPSS, and KEV status; pivoting to the actors known to exploit it on actors.mlab.sh tells you whose playbook to assume if the patch went on late.
What this means for prioritization
Turn the pattern into policy:
- Weight exploitation evidence above severity. KEV listing or vendor-confirmed exploitation beats any CVSS score. EPSS covers the predictive gap for everything not yet on KEV.
- Pre-classify your hot assets. Maintain a standing list of internet-facing edge devices, remote access infrastructure, and file transfer systems. Any CVE touching that list starts life as an emergency, whatever its score.
- Set class-based SLAs. 24 to 72 hours for exploited or KEV-listed bugs on exposed assets. Do not renegotiate per incident.
- Patch and then hunt. For edge device CVEs, patching late means assuming compromise during the window. Terminate active sessions, rotate credentials and tokens that transited the device, and sweep for persistence. Citrix Bleed victims who patched but did not kill sessions stayed compromised.
- Use actor context for the hunt, not the patch decision. The patch decision is nearly universal; the post-exposure hunt is actor-specific.
The uncomfortable summary
The vulnerabilities that hurt organizations are not exotic. They are a predictable rotation of edge device bugs, data-concentrator injections, and ubiquitous library flaws, exploited within days by everyone from botnet operators to state-linked groups, and still exploited years later wherever patching stalled.
You cannot patch 40,000 CVEs a year. You can absolutely patch the two dozen that actors are actually using against systems like yours, fast enough to matter. Knowing which two dozen: that is the entire game.
