# What is a Vulnerability?

> A vulnerability is a weakness or adverse condition in a system, product, process, control, or implementation that a threat could exploit or an event could trigger, causing unintended security consequences.

- Canonical URL: https://yellowcube.eu/glossary/vulnerability/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It may arise from design, code, configuration, deployment, procedure, or a dependency. The term describes the weakness itself — not an exploit, an attack, or the likelihood and impact that make up risk.

Whether a vulnerability matters in a particular environment depends on affected versions, deployment, reachability, existing safeguards, available attack paths, and the consequences of compromise. Those factors should inform treatment without changing the underlying definition.

### Key points

- **Possible origins:** Vulnerabilities can result from flawed assumptions, implementation errors, insecure defaults, missing controls, unsafe composition, operational mistakes, or weaknesses inherited from third parties.
- **Evidence and validation:** Findings may come from research, testing, scanning, code review, incident analysis, supplier advisories, or coordinated disclosure, and often require confirmation against the actual environment.
- **Treatment choices:** Depending on context, an organization may remediate the weakness, reduce exposure, add a compensating control, retire the affected component, or explicitly accept the remaining risk.
- **Important limitation:** Discovering a vulnerability does not prove that it is reachable, exploitable, actively exploited, or high impact in every deployment; absence of a finding likewise does not prove that no vulnerability exists.

### Related terms

[Exploit](<https://yellowcube.eu/glossary/exploit/>) · [Security misconfiguration](<https://yellowcube.eu/glossary/security-misconfiguration/>) · [Zero-day vulnerability](<https://yellowcube.eu/glossary/zero-day-vulnerability/>) · [Vulnerability management](<https://yellowcube.eu/glossary/vulnerability-management/>) · [Cyber risk](<https://yellowcube.eu/glossary/cyber-risk/>)

### Sources

[NIST: Vulnerabilities](https://csrc.nist.gov/topics/security-and-privacy/risk-management/vulnerabilities) · [NIST glossary: Vulnerability](https://csrc.nist.gov/glossary/term/vulnerability) · [NIST SP 800-53 Rev. 5](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.