Detected does not mean harmless

Is it possible to exploit a “theoretical” vulnerability?