Vulnerability

In security engineering a vulnerability is a specific weakness in a system, process or human behaviour that a threat can exploit to compromise confidentiality, integrity or availability. Publicly known software and hardware flaws are tracked through an ecosystem of identifiers. A CVE (Common Vulnerabilities and Exposures) ID, assigned by a CVE Numbering Authority, names a particular flaw in a particular product; a CWE (Common Weakness Enumeration) names the underlying class of defect (for example CWE-79 cross-site scripting or CWE-89 SQL injection), so many CVEs share one CWE root cause. The US National Vulnerability Database (NVD) enriches CVE records, and since May 2025 ENISA operates the European Vulnerability Database (EUVD), established under the NIS2 Directive, as an EU-maintained source that cross-references existing databases.

Severity is communicated with the Common Vulnerability Scoring System (CVSS), which produces a 0-10 score from a vector of metrics. The base metrics (attack vector, attack complexity, privileges required, user interaction, scope, and impact to confidentiality, integrity and availability) describe intrinsic severity; temporal and environmental metrics adjust for exploit maturity and the specific deployment. CVSS v3.1 remains widely used, and v4.0 was published in 2023 to address criticisms and add finer granularity. A crucial nuance is that CVSS measures technical severity, not risk: it does not tell you how likely the flaw is to be exploited in your environment, which is why prioritisation increasingly adds EPSS (the Exploit Prediction Scoring System, a probability that a CVE will be exploited in the wild) and CISA's Known Exploited Vulnerabilities (KEV) catalogue, which lists flaws with confirmed active exploitation and should be patched first regardless of CVSS.

Vulnerabilities are found through code review, SAST and DAST, dependency and container scanning (software composition analysis), penetration testing and bug-bounty research. Handling them well means Coordinated Vulnerability Disclosure (ISO/IEC 29147 for receiving reports and 30111 for handling them), in which a researcher privately notifies the vendor, a fix is prepared, and details are published together with the patch; NIS2 Article 12 established an EU coordinated-disclosure framework and the CSIRT role in it. Operationally, vulnerability management is a continuous lifecycle - asset inventory, scanning, prioritisation, remediation and verification.

Two misconceptions recur. First, that a high CVSS score always means urgent action: a critical flaw with no known exploit and no exposure to attackers may rank below a medium flaw that is being exploited today, which is why exploitability and exposure, not severity alone, drive good prioritisation. Second, that a vulnerability is purely a software bug; misconfiguration, weak processes and human susceptibility (the target of social engineering) are vulnerabilities too, and often the most exploited. A vulnerability differs from a threat (the potential cause of harm that must find a weakness to act on) and from an exploit (the concrete technique or code that leverages the weakness); a zero-day is simply a vulnerability for which no patch yet exists when it is first exploited.