A vulnerability is a weakness in a system, application, or process that a threat can exploit to cause harm. Weaknesses live in many places: unpatched software, buffer overflows, default passwords, open ports, missing access reviews, and people who fall for phishing.
Managing vulnerabilities is a cycle, not a single scan. It means discovering weaknesses continuously, judging each one by how exploitable it is and how much damage it would do, then remediating through patches, configuration changes, or compensating controls when a fix is not yet possible. Prioritization matters because no team can fix everything at once, so a critical flaw on an internet-facing server outranks a minor issue on an isolated host. A frequent misstep is treating every high score from a scanner as equally urgent without weighing real exposure.
How is vulnerability tested on the CISSP?
Vulnerabilities are central to Domain 6, Security Assessment and Testing, and also surface in risk assessment and operations. The exam separates vulnerability scanning from penetration testing and expects familiarity with scoring systems like CVSS. Study Domain 6: Security Assessment and Testing.
Disclosed flaws are tracked in the National Vulnerability Database.