What Is a Vulnerability in Cyber Security? Types, CVE, CVSS and Management

Vulnerability, Threat and Risk: Three Different Words

These terms are often mixed up. A vulnerability is a weakness, for example an outdated plugin on a website. A threat is something or someone that could exploit it, such as a criminal using an automated scanner. Risk is the combination of how likely exploitation is and how bad the impact would be. A vulnerability on an isolated test machine with no data poses low risk; the same vulnerability on an internet-facing payment server poses very high risk. Security teams therefore do not just ask “is there a vulnerability?” but “how much does this one matter here?”

Types of Vulnerabilities

• Software bugs: memory corruption, injection flaws, logic errors and race conditions in applications and operating systems.
• Misconfigurations: default passwords, open ports, public cloud storage and excessive permissions.
• Missing patches: known flaws for which fixes exist but have not been installed.
• Weak authentication: easily guessed passwords, missing MFA and shared accounts.
• Insecure design: architecture without proper trust boundaries or validation.
• Human factors: susceptibility to phishing and poor handling of data.
• Physical weaknesses: unlocked server rooms and unattended devices.
• Third-party risk: flawed libraries, vendors and APIs.
• Zero-days: flaws unknown to the vendor.

CVE, CWE and CVSS Explained

To talk about flaws consistently, the industry uses three systems. CVE (Common Vulnerabilities and Exposures) assigns unique IDs such as CVE-2021-44228 to specific publicly disclosed vulnerabilities. CWE (Common Weakness Enumeration) classifies types of weakness, such as CWE-89 for SQL injection. CVSS (Common Vulnerability Scoring System) gives a severity score from 0 to 10, based on factors like attack vector, complexity, privileges required and impact. Scores are commonly grouped as low, medium, high and critical.

CVSS is a starting point, not the final word. Context such as exposure to the internet, availability of exploit code, business criticality and compensating controls should influence priority. Many teams also consult lists of actively exploited vulnerabilities to decide what to fix first.

The Vulnerability Management Lifecycle

1. Discover assets: you cannot patch what you do not know exists.
2. Scan: use authenticated and unauthenticated scans with tools like Nessus, OpenVAS and Qualys.
3. Validate: remove false positives and confirm exploitability when needed.
4. Prioritise: combine severity, exploitability and business impact.
5. Remediate: patch, reconfigure, apply workarounds or accept the risk formally.
6. Verify: rescan to confirm the fix.
7. Report and improve: track metrics such as time to remediate and recurring issues.

Vulnerability Assessment vs Penetration Testing

A vulnerability assessment is broad and mostly automated: it lists weaknesses and ranks them. A penetration test is deeper and manual: testers try to exploit weaknesses and chain them to show real impact. Most organisations perform both, which is why the combined service is called VAPT. Read what is VAPT and what is penetration testing for details.

Real-World Lessons From Famous Vulnerabilities

The Heartbleed flaw in OpenSSL (2014) showed that a bug in a widely used library could expose memory from servers worldwide. Shellshock (2014) affected the Bash shell, and EternalBlue-related flaws in Windows SMB powered WannaCry in 2017. Log4Shell (2021) in the Log4j logging library affected countless applications because the library was embedded deeply in software supply chains. The common lessons: maintain an inventory of components, patch quickly, monitor for exploitation and reduce unnecessary exposure.

Reducing Vulnerabilities in Practice

Reduce attack surface by disabling unused services, enforce secure configuration baselines (CIS Benchmarks), update promptly, apply least privilege, use secure coding practices and code review, scan dependencies for known flaws, and test applications before release. Train staff to report suspicious behaviour. Learners who want to find vulnerabilities professionally can join the ethical hacking course and the penetration testing course, while compliance-minded learners may prefer the GRC and ISO 27001 course.

Common Misconceptions About Vulnerabilities

• “Critical CVSS always means fix first.” Exposure and exploitability change priority.
• “Patched means safe.” Misconfigurations and logic flaws remain.
• “Only software has vulnerabilities.” Processes and people do too.
• “Scanning once a year is enough.” New vulnerabilities appear daily.
• “Zero-day means very advanced.” It means unpatched and unknown to the vendor.

Hands-On Exercise: Rank Five Vulnerabilities

Take five sample findings: an outdated library on an internal test server, an exposed admin panel with default credentials, a missing HTTP security header, a critical RCE on an internet-facing server and a weak password policy. Score each using the CVSS calculator, then adjust priority using business context. Defend your ranking in a short paragraph. Interviewers ask such questions to test practical judgement.

Self-Test

1. What does CVE identify? (A specific publicly known vulnerability.)
2. What does CWE classify? (Types of weakness.)
3. Define risk. (Likelihood multiplied by impact.)
4. Name a scanner. (Nessus or OpenVAS.)
5. What is the last step of vulnerability management? (Verification and reporting.)

Illustrative Scenario: Patch Prioritisation

A company’s scanner reports 3,000 findings. The team cannot fix them all at once. They filter for vulnerabilities on internet-facing assets with known exploits, reducing the list to 40. They patch these within a week, schedule medium-risk internal items for the monthly cycle and accept a few low risks with documented justification. Two months later a widely exploited flaw hits the industry; because they prioritised well, they were already protected. Prioritisation, not volume of fixes, delivers security.

Practical Tips for Managing Vulnerabilities

• Maintain an accurate asset inventory; unknown assets are unpatched assets.
• Subscribe to advisories for your key products.
• Set SLAs by severity, such as critical within 7 days.
• Track exceptions with expiry dates.
• Measure and report the average time to remediate.

Where to Go Next: Practice and Resources

Foundational topics become easier once you see how they connect. Treat each article as one piece of a map: networks carry data, operating systems run services, applications process input, people make decisions and attackers look for the weakest link among them. Revisit the basics regularly, because later topics such as cloud security and incident response build directly on them.

• Official documentation and RFCs for protocols you use daily.
• OWASP and MITRE ATT&CK websites for structured knowledge.
• Beginner labs on guided learning platforms.
• Government awareness portals for scams and safe practices.
• A study partner with whom you can explain concepts to each other.

More Questions Learners Ask

How can I test whether I really understand a concept?

Try to explain it in two minutes to a non-technical friend and then demonstrate it in a lab.

Are free resources enough for fundamentals?

They are a good start, but structured feedback from a live course helps you avoid gaps.

How often do fundamentals change?

Core principles change slowly, while tools and threats change quickly, so invest more in principles.

Which fundamentals matter most for employers?

Networking, Linux and Windows basics, common attack types and clear communication.

Do I need to memorise all these terms?

No. Understand the idea behind each term and how it appears in a real incident; vocabulary becomes natural through labs and repetition.

What is the best order to learn security topics?

Start with networking and operating systems, then threats and controls, then hands-on labs, and finally a specialisation.

Interview Questions Related to This Topic

Employers often use fundamentals like these to check whether a candidate really understands a topic. Try answering in your own words before reading the model answer.

What is the difference between vulnerability assessment and penetration testing?

An assessment identifies and ranks weaknesses, often with automated scans; a penetration test attempts to exploit them to demonstrate impact. The deliverable of the latter is an attack narrative with proof.

What is hashing and why are salts used?

Hashing creates a fixed-length fingerprint of data and cannot be reversed easily. Salts are random values added before hashing passwords so identical passwords produce different hashes and precomputed attacks fail.

Explain the CIA triad.

Confidentiality keeps data secret from unauthorised people, integrity ensures it is not altered improperly and availability ensures it can be used when needed. Controls such as encryption, hashing and backups map to each.

Terms to Remember

A shared vocabulary makes learning faster. These terms appear repeatedly in classes, labs and interviews:

• DDoS: A distributed denial-of-service attack that floods a service with traffic until legitimate users cannot reach it.
• Threat intelligence: Analysed information about attackers, tools and indicators that helps defenders prioritise and detect threats.
• Brute force: Trying many passwords or keys automatically until one works; rate limiting and MFA reduce the risk.
• CERT-In: India’s national agency for responding to cyber security incidents, which issues advisories and reporting directions.
• Ransomware: Malware that encrypts files and demands payment for the key; modern variants also steal data first to threaten publication.
• VPN: An encrypted tunnel between a device and a network, used for secure remote access.

Learn This Hands-On: Recommended Courses

Reading builds understanding, but practice builds skill. If this topic interests you, the best next steps are Penetration Testing Course, Ethical Hacking Course and Cyber Security GRC & ISO 27001 Course. Every course includes live labs, and a new batch starts every week. You can try a free demo class first, compare fees or read about the cyber security course in your city.

Related reading: What Is VAPT in Cyber Security? Vulnerability Assessment and Penetration Testing Explained • What Is Penetration Testing? Types, Phases, Tools and Reports • What Is the CIA Triad in Cyber Security? Confidentiality, Integrity, Availability.