Vulnerability (computer security)
A flaw exploitable to compromise system security.
In computer security, a vulnerability is a bug or design flaw in hardware, software, or how a system is managed that an attacker can exploit to break security. Even when administrators try hard to make everything correct, almost all hardware and software have errors. If one of those errors lets an attacker harm the confidentiality, integrity, or availability of system resources, it counts as a vulnerability. Poor development practices and design choices—like making systems overly complex—can make vulnerabilities more common. Managing vulnerabilities means figuring out which systems matter most, scanning them for flaws, and then fixing, reducing, or accepting the risk. Severity is measured using the Common Vulnerability Scoring System (CVSS), and vulnerabilities are listed in databases like the Common Vulnerabilities and Exposures (CVE) database, which by April 2026 had recorded over 327,000 entries. A vulnerability starts when it's introduced into hardware or software, becomes active and exploitable when that system is running, and may be found by an administrator, vendor, or third party. Publicly revealing a vulnerability—through a patch or otherwise—raises the risk of attack, since attackers can target unpatched systems. The vulnerability ends only when the system is patched or taken out of use.
- field
- Computer security
- known_for
- Flaw or weakness exploitable to compromise system security
- classification_system
- Common Vulnerability Scoring System (CVSS)
- database
- Common Vulnerabilities and Exposures (CVE)
- recorded_vulnerabilities
- More than 327,000 as of April 2026
Lore & Background
Vulnerabilities are initiated when introduced into hardware or software and become active and exploitable when the system is running. They may be discovered by the administrator, vendor, or a third party. Public disclosure of a vulnerability, through a patch or otherwise, is associated with an increased risk of compromise because attackers can use that knowledge to target systems before patches are implemented. A vulnerability ends when the system is either patched or removed from use. Vulnerabilities vary in their ability to be exploited; some allow only denial-of-service attacks, while more dangerous ones enable code injection without the user's awareness. Only a minority allow privilege escalation, which is typically necessary for more severe attacks. Without a vulnerability, an exploit typically cannot gain access, though malware can be installed directly through social engineering or poor physical security.
Reader's Guide
Vulnerability management is a critical practice that includes identifying systems, prioritizing which are most important, scanning for vulnerabilities, and taking action to secure the system. It typically combines remediation, mitigation, and acceptance. Design factors such as complexity, familiarity, connectivity, and legacy software increase the burden of vulnerabilities. Poor development practices—including lack of secure coding training, excessive delivery pressure, complex code bases, and inadequate code reviews—also contribute. The National Vulnerability Database classifies vulnerabilities into eight root causes, including input validation, access control, exception handling, configuration, and race conditions. Vulnerabilities exist across components: hardware can have deliberate security bugs introduced during manufacturing; operating systems commonly suffer privilege escalation bugs; client-server applications face unencrypted data and process hijacking; and web applications are a leading source of data breaches due to authentication failures, business logic flaws, cross-site scripting, SQL injection, command injection, and cross-site request forgery.
Did You Know?
- As of April 2026, more than 327,000 vulnerabilities had been recorded in the CVE database.
- Only a minority of vulnerabilities allow for privilege escalation, which is typically necessary for more severe attacks.
- Publicly disclosing a vulnerability is associated with an increased risk of compromise before patches are implemented.
- Vulnerabilities can be scored for severity according to the Common Vulnerability Scoring System (CVSS).
Frequently Asked Questions
What is a vulnerability in computer security?
A vulnerability is a flaw in hardware, software, or system management that a malicious actor can leverage to compromise a system's confidentiality, integrity, or availability. It is more specific than a generic bug: the error must create a concrete exploitable path for an attacker.
How are vulnerabilities scored and tracked?
The Common Vulnerability Scoring System (CVSS) provides a standardized severity rating for each identified flaw. Every entry is also logged in the Common Vulnerabilities and Exposures (CVE) database, which acts as the central public registry.
How many vulnerabilities have been recorded to date?
As of April 2026, more than 327,000 distinct vulnerabilities have been catalogued in the CVE database. That figure spans decades of discovery across virtually every major platform and product.
What separates a regular software bug from a security vulnerability?
A routine bug might cause a crash or produce wrong output, but a vulnerability specifically enables an attacker to harm the confidentiality, integrity, or availability of system resources. Without that exploitable compromise path, the flaw is not classified as a vulnerability.
Why do vulnerabilities keep appearing even when teams follow best practices?
Complexity in design and development inevitably introduces errors, and no administrator can eliminate every flaw in hardware or software. Overly intricate architectures and rushed development habits only widen the surface area where exploitable weaknesses can hide.
More in Science And Technology 1-20
Spotted an error? Know more?
This is a living reference — every entry is fact-audited, and reader corrections feed straight into our audit queue. Suggest an edit · See this site's audit record