Vulnerability

What is a vulnerability?

In cybersecurity, a vulnerability is a flaw or weakness in a system---software, hardware, network, or process---that can be exploited by a threat actor to gain unauthorized access, execute code, leak data, or disrupt services.

A vulnerability by itself is a condition; risk arises when it is exploitable and exposed.

Why vulnerabilities matter

Vulnerabilities are critical because they:

• Enable real-world cyberattacks
• Are the entry point for exploits and malware
• Drive incident response and patching priorities
• Impact confidentiality, integrity, and availability (CIA triad)
• Affect compliance and regulatory posture

Managing vulnerabilities is foundational to security.

Common types of vulnerabilities

Vulnerabilities can occur at many layers:

• Software vulnerabilities -- bugs, logic flaws, unsafe functions
• Configuration weaknesses -- default credentials, open services
• Network vulnerabilities -- exposed ports, weak segmentation
• Authentication flaws -- weak passwords, missing MFA
• Design flaws -- insecure architectures or trust assumptions
• Supply-chain vulnerabilities -- third-party components

Attackers target the weakest exposed link.

Vulnerability vs threat vs exploit

Term	Meaning
Vulnerability	The weakness
Threat	The potential adversary or risk
Exploit	The method used to abuse the weakness

All three are required for a successful attack.

Vulnerabilities and CVEs

Many vulnerabilities are tracked using CVE identifiers:

• Provide a unique reference for each issue
• Enable coordination across vendors and tools
• Support vulnerability scanning and reporting

Not all vulnerabilities receive a CVE, especially internal or misconfiguration issues.

Severity and scoring (CVSS)

Vulnerabilities are often rated using CVSS:

• Measures exploitability and impact
• Produces a score from 0.0 to 10.0
• Helps prioritize remediation

Severity does not equal risk; context matters.

Vulnerability lifecycle

A typical lifecycle includes:

1. Discovery (research or incident)
2. Disclosure (responsible or public)
3. Assignment of identifiers (e.g., CVE)
4. Patch or mitigation release
5. Exploitation in the wild (sometimes)
6. Remediation and verification

Timing is critical to reduce exposure.

Vulnerabilities in real attacks

In practice, vulnerabilities are used to:

• Gain initial access (e.g., RCE)
• Escalate privileges
• Move laterally
• Deploy malware or ransomware
• Exfiltrate data

Many breaches involve known, unpatched vulnerabilities.

Detection and management

Effective vulnerability management includes:

• Asset inventory and exposure mapping
• Vulnerability scanning
• Patch and update management
• Configuration hardening
• Risk-based prioritization
• Continuous monitoring and validation

Automation improves scale and consistency.

Common misconceptions

• "A vulnerability always means compromise"
• "Critical CVSS scores are always urgent"
• "Firewalls eliminate vulnerabilities"
• "Patching once is enough"

Security posture is continuous, not static.