In general, the exploit has been (however systematically) stumbled upon, or felt through like a person navigating a physical maze.

Nobody would say that person "created" the solution to the maze.

The maze is solvable (that's the latent vulnerability), the person "discovered" the way through.