Which Cyber Kill Model category does attacking vulnerability belong to?

Exploitation is the Kill Chain phase immediately following Delivery where the attacker's exploit code fires against a specific vulnerability - such as a buffer overflow, use-after-free, or unpatched CVE - to achieve code execution or privilege escalation on the target system. This phase represents the literal act of attacking a vulnerability, as the weakness in software or hardware is abused to cross the security boundary. Exploitation must succeed before the attacker can advance to Installation or later phases.

Installation occurs after successful exploitation and involves placing a persistent mechanism - such as a web shell, rootkit, or remote access trojan - on the already-compromised system to maintain access.

Delivery is the phase where the weaponized payload is transmitted to the target environment (for example via phishing email or watering hole attack) but the vulnerability has not yet been triggered or attacked.

Actions on Objectives is the final Kill Chain phase where the attacker accomplishes their mission goals such as data exfiltration or destructive action, occurring well after initial exploitation.