What Is Vulnerability?

Vulnerability, in information security and systems engineering, is a weakness in a system's design, implementation, configuration, or operational procedures that an adversary or other actor can exploit to compromise the confidentiality, integrity, or availability of that system. The term applies to hardware, firmware, operating systems, application software, network protocols, and organizational processes alike. A vulnerability alone does not produce harm; it requires a threat agent capable of exploiting it and an attack path to reach it, but identifying and mitigating vulnerabilities before exploitation is the primary goal of proactive security engineering.

The concept is formally defined in the NIST Computer Security Resource Center glossary as "a weakness in the computational logic found in software and hardware components that, when exploited, results in a negative impact to confidentiality, integrity, or availability." This definition has become the practical standard referenced by standards bodies, software vendors, and government agencies.

Classification and Root Causes

Vulnerabilities arise from several root causes. Memory safety errors, including buffer overflows, use-after-free conditions, and integer overflows, have accounted for the largest share of critical exploits in systems software over several decades. Injection flaws allow adversary-controlled data to be interpreted as instructions, the most prominent category being SQL injection in web application databases. Authentication and access control weaknesses permit unauthorized actors to escalate privileges or bypass authentication entirely. Configuration vulnerabilities stem from default credentials, exposed administrative interfaces, or misconfigured security controls rather than coding defects.

The Common Weakness Enumeration (CWE), maintained by MITRE and endorsed by NIST, provides a hierarchical taxonomy of over 900 named weakness types, giving developers and reviewers a shared vocabulary for describing root causes. Each weakness type in the CWE list has associated consequences and observed examples drawn from real software.

Vulnerability Discovery and Disclosure

Vulnerabilities are discovered through several channels: static analysis of source or binary code, dynamic testing and fuzzing, manual code review, and operational incident investigation. Security researchers who identify vulnerabilities in commercial products typically follow coordinated disclosure practices, notifying the vendor privately and allowing a negotiated period for patch development before publishing technical details.

The Common Vulnerabilities and Exposures (CVE) program, administered by MITRE and sponsored by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), assigns a unique identifier to each publicly known vulnerability. As of 2025, the CVE list contained more than 230,000 entries. CVE identifiers serve as the reference keys in NIST's National Vulnerability Database (NVD), which enriches each entry with severity scores, affected product lists, and remediation references. Organizations consult the NVD to prioritize patching and assess exposure in their software inventories.

Severity Scoring and Remediation

The Common Vulnerability Scoring System (CVSS), developed by the Forum of Incident Response and Security Teams (FIRST) and now in version 4.0, provides a standardized numeric severity score from 0 to 10 for each vulnerability based on metrics including attack vector, attack complexity, privileges required, user interaction, and impact on the three security properties. A base score above 9.0 is designated Critical and typically triggers emergency patching procedures. Severity alone does not determine remediation priority; asset exposure, exploitability in the wild, and compensating controls also factor into risk decisions. CISA publishes a Known Exploited Vulnerabilities catalog that identifies CVEs confirmed to have been actively exploited, providing a direct prioritization signal for federal agencies and widely adopted by the broader industry.

Applications

Vulnerability management has applications in a wide range of disciplines, including:

• Enterprise software patch management and security operations center workflows
• Medical device and industrial control system security assessment
• Automotive embedded systems security under ISO/SAE 21434
• Cloud infrastructure security posture management
• Defense and critical infrastructure protection under national cybersecurity frameworks