Exploitation is the use of a vulnerability to violate the security policy it undermines; the possibility and evidence of exploitation bear on disclosure timing and on the severity and impact an advisory states, and ISO/IEC 30111 7.1.4 e) and 7.1.5 a) weigh likelihood of exploitation and active exploitation in prioritization and remediation decisions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.