An exploit is a program, or piece of code, designed to find and take advantage of a security flaw or vulnerability in an application or computer system, typically for malicious purposes such as installing malware. An exploit is not malware itself, but rather it is a method used by cybercriminals to deliver malware.
For exploits to be effective, many vulnerabilities require an attacker to initiate a series of suspicious operations to set up an exploit. Typically, a majority of the vulnerabilities are result of a software or system architecture bug. Attackers write their code to take advantage of these vulnerabilities and inject various types of malware into the system.