How Attackers Choose Which CVEs to Exploit: Real-World Analysis
Somewhere right now, an attacker is staring at a list of 200 newly published CVEs.
They will not exploit all 200.
They will choose one.
Not based on severity score. Not based on headlines. But based on operational value.
This is the first truth every analyst must understand:
Vulnerabilities do not create breaches. Exploitation decisions do.
In our recent analysis of the Microsoft February 2026 exploited zero-days , attackers didn’t rely on one breakthrough exploit. They chained multiple trust failures — bypassing SmartScreen warnings, abusing MSHTML trust assumptions, and escalating privileges to SYSTEM level.
Similarly, in the Apple dyld zero-day (CVE-2026-20700) , attackers didn’t begin with full control. They began with limited access — then escalated by exploiting trust inside the operating system’s own loader.
These incidents reveal a deeper truth:
Attackers exploit pathways — not vulnerabilities.
The Attacker’s Decision Model: Exploit Value vs Exploit Cost
Attackers evaluate CVEs using a simple internal logic:
Exploit Value > Exploit Cost = Target
Exploit Value includes:
- Access gained
- Number of vulnerable systems
- Data or privilege impact
Exploit Cost includes:
- Exploit complexity
- Detection risk
- Patch adoption speed
The higher the value and lower the cost, the more attractive the CVE becomes.
Stage 1: Attackers Prioritize Maximum Reach
Attackers prefer vulnerabilities affecting widely deployed systems.
Real Example: Log4Shell (CVE-2021-44228)
Log4Shell affected the Apache Log4j logging library, which is embedded in millions of enterprise systems worldwide. It allowed attackers to execute arbitrary code remotely simply by sending specially crafted input strings.
This created a perfect attack surface:
- Cloud systems
- Banking systems
- Government infrastructure
- Enterprise software
Why attackers chose it:
- Massive global reach
- One exploit could target thousands of organizations
- Extremely common dependency
Within days of disclosure, attackers deployed:
- Ransomware
- Crypto miners
- Backdoors
- Espionage malware
Nation-state groups, ransomware operators, and botnet operators all exploited it simultaneously.
This is exploit economics.
Stage 2: Attackers Prioritize Remote Access
Remote Code Execution (RCE) vulnerabilities are highly valuable because they provide immediate system control.
Real Example: Microsoft Exchange Server Exploit Chain
- Attacker sends crafted request to Exchange server
- Exploit allows initial access
- Attacker escalates privileges to administrator
- Attacker installs web shell backdoor
- Attacker steals emails, credentials, and deploys ransomware
Once inside, attackers had complete control over enterprise communication infrastructure.
Why attackers chose it:
- Internet-exposed servers
- Direct access to sensitive data
- Ability to establish persistent backdoor access
This attack compromised thousands of organizations globally.
Stage 3: Attackers Prioritize Privilege Escalation Vulnerabilities
Some vulnerabilities don’t provide initial access—but allow attackers to escalate privileges once inside.
Real Example: Dirty COW (CVE-2016-5195)
Dirty COW was a Linux kernel race condition vulnerability that allowed attackers to gain root privileges.
- Attackers could modify system files
- Gain root access
- Install persistent malware
This vulnerability became extremely valuable because attackers could combine it with other exploits to gain complete system control.
This demonstrates a key attacker strategy: Exploit chaining.
Stage 4: Attackers Prioritize Easy-to-Exploit Vulnerabilities
Attackers prefer vulnerabilities that require minimal effort.
- No authentication required
- Single network request exploitation
- Public exploit code availability
- Reliable exploit success rate
This reduced attacker effort and increased exploitation scale.
Stage 5: Attackers Exploit Patch Delay Windows
Even after vulnerabilities are disclosed, organizations often delay patching.
This delay is called the Patch Gap.
Attackers actively scan the internet for vulnerable systems during this period.
Stage 6: Attackers Chain Multiple CVEs to Achieve Full Compromise
- Exploit external vulnerability for initial access
- Exploit privilege escalation vulnerability
- Install backdoor
- Move laterally across network
- Deploy ransomware or steal data
Attackers combine vulnerabilities like puzzle pieces to achieve full compromise.
Stage 7: Attackers Prioritize Persistence, Not Just Access
Initial access is only the beginning.
- Web shells
- Backdoors
- Credential stealers
These allow attackers to maintain long-term control.
The Exploitation Lifecycle: How a CVE Becomes a Breach
- Stage 1: Vulnerability discovery
Security researchers identify flaw. - Stage 2: Disclosure
CVE assigned and published. - Stage 3: Exploit development
Attackers create exploit code. - Stage 4: Mass scanning
Attackers scan internet for vulnerable systems. - Stage 5: Exploitation
Attackers compromise vulnerable systems. - Stage 6: Persistence
Attackers install backdoors. - Stage 7: Impact
Attackers deploy ransomware, steal data, or spy.
The Most Important Analyst Insight: Exploitability Matters More Than Severity
- Exploit reliability
- System prevalence
- Access value
- Patch adoption speed
Not just CVSS score.
Analyst Perspective: What This Means for Defense
- Internet-facing vulnerabilities
- Remote exploitable vulnerabilities
- Actively exploited vulnerabilities
- Widely deployed system vulnerabilities
The Reality: CVEs Are Not the Threat — Trust Failures Are
- Software trusting untrusted input
- Systems trusting external data
- Networks trusting unauthenticated users
Attackers exploit trust. Not software.
Final Insight for Analysts
Do not ask: “What does this CVE do?”
Ask: “Why would an attacker care about this CVE?”
That question reveals real risk.
That question builds real analysts.
Stay Alert. Stay Human. Stay Safe.
— ZyberWalls Research Team
Comments
Post a Comment