A software vulnerability is a weakness in code, design, configuration, or operation that can be used to compromise a system's confidentiality, integrity, or availability. A vulnerability may expose data, allow unauthorized access, increase privileges, or interrupt a service.
Vulnerability, bug, exploit, and risk
- A bug is any unintended software behavior. A bug becomes a security vulnerability when it creates a practical security weakness.
- An exploit is code or a technique used to trigger a vulnerability.
- Risk combines the likelihood of exploitation with the possible impact in a particular environment.
The same vulnerability can be urgent on a public server and much less exposed on an isolated test device. Severity scores help comparison, but they do not replace knowledge of the affected system.
Common examples
- Missing authorization checks that expose another user's records.
- Unsafe input handling that permits SQL injection or command execution.
- Memory-safety errors that can crash software or run attacker-controlled code.
- Default passwords, excessive permissions, or exposed management interfaces.
- Outdated third-party libraries with a known security flaw.
CVE and CVSS
A publicly disclosed vulnerability may receive a CVE identifier so vendors and defenders can refer to the same issue. CVSS is one method for describing technical severity. Neither an identifier nor a high score proves that every installation is exploitable; version, configuration, exposure, and available mitigations still matter.
What users should do
- Install operating-system, browser, application, and device updates from the official vendor.
- Replace products that no longer receive security fixes.
- Remove software and browser extensions that are not needed.
- Be cautious with urgent messages that claim a special patch is attached; vendors normally distribute fixes through official update channels.
What administrators should do
- Maintain an inventory of assets, versions, owners, and internet exposure.
- Monitor vendor advisories and trusted vulnerability sources.
- Prioritize active exploitation and critical exposed systems, then test and deploy the software patch.
- Use compensating controls such as access restrictions or feature disablement when no fix exists.
- Verify remediation with version checks and targeted scanning.
Read Exploit to understand how a weakness is used in an attack, and Zero-Day Attack for vulnerabilities exploited before a practical fix is available.