Editing Vulnerability (computer security) (section)

{{merge from|security bug|discuss=Talk:Vulnerability (computer security)#Merge proposal|date=May 2025}}
{{short description|Exploitable weakness in a computer system}}
{{Computer hacking}}
'''Vulnerabilities''' are flaws or weaknesses in a system's design, implementation, or management that can be exploited by a malicious actor to compromise its security.

Despite a [[system administrator]]'s best efforts to achieve complete correctness, virtually all hardware and software contain [[Software bug|bugs]] where the system does not behave as expected. If the bug could enable an attacker to compromise the [[confidentiality]], [[Data integrity|integrity]], or [[availability]] of system resources, it can be considered a vulnerability. Insecure [[software development]] practices as well as design factors such as complexity can increase the burden of vulnerabilities.

[[Vulnerability management]] is a process that includes identifying systems and prioritizing which are most important, scanning for vulnerabilities, and taking action to secure the system. Vulnerability management typically is a combination of remediation, mitigation, and acceptance.

Vulnerabilities can be scored for risk according to the [[Common Vulnerability Scoring System]] (CVSS) and added to vulnerability databases such as the [[Common Vulnerabilities and Exposures]] (CVE) database. As of November 2024, there are more than 240,000 vulnerabilities catalogued in the CVE database.<ref name="Metrics">{{cite web |url=https://www.cve.org/About/Metrics |title=CVE - Program Metrics |date=15 November 2024 }}</ref>

A vulnerability is initiated when it is introduced into hardware or software. It becomes active and exploitable when the software or hardware containing the vulnerability is running. The vulnerability may be discovered by the administrator, vendor, or a third party. [[Coordinated vulnerability disclosure|Disclosing the vulnerability]] (through a [[Patch (computing)|patch]] or otherwise) is associated with an increased risk of compromise, as attackers can use this knowledge to target existing systems before patches are implemented. Vulnerabilities will eventually end when the system is either patched or removed from use.