Vulnerability

Overview

Vulnerabilities can exist in software, hardware, cryptography, identities, business logic, procedures, facilities, or human workflows. They may permit unauthorized access, disclosure, alteration, denial of service, fraud, privilege escalation, or violation of an intended security property.

A weakness is not the same as active exploitation, and severity depends on reachability, prerequisites, affected assets, compensating controls, and business consequence. Published scores help prioritize but cannot capture every deployment, chained attack path, or exposure created by local configuration.

Organizations should maintain asset and dependency inventories, accept reports safely, reproduce findings, assess context, assign owners, remediate or mitigate, and verify fixes. Disclosure, patching, exceptions, and residual risk need documented timelines, while threat intelligence and incidents update priorities.

A vulnerability is a weakness in design, implementation, configuration, process, or behavior that a threat can exploit to cause harm. A vulnerability becomes meaningful through its reachable attack path and consequence, so remediation priority must reflect real system context and verified exposure.

Assessment of Vulnerability should trace a weakness in design, implementation, configuration, process, or behavior that a threat can exploit to cause harm from prerequisite and entry point through observable impact on the affected service. A theoretical weakness or scanner result involving weakness in design, implementation, and configuration should not be reported as exploitation without corroborating logs, transactions, or configuration evidence. Prevention, detection, containment, and recovery for the weakness should be tested against the architecture associated with weakness in design, implementation, and configuration.

Retesting for Vulnerability should reproduce the weakness involving weakness in design, implementation, and configuration, examine adjacent paths, and verify the conditions for safely returning the affected service to normal operation.