A network security vulnerability is a weakness in a network device, protocol, service or configuration that an attacker could use to gain access, disrupt service or read data. It may be a software flaw, a default password or an open port. Fix by exposure and known exploitation first, not by score alone.
What forms does it take?
Software flaws. Routers, firewalls, VPN gateways and servers run code, and code has bugs. Published flaws get CVE identifiers so that everyone can refer to the same issue.
Misconfiguration. A management interface open to the internet, a permissive firewall rule, an unused service left running or an unencrypted protocol where an encrypted one exists.
Weak authentication. Default credentials and shared accounts. MITRE ATT&CK includes Default Accounts under Valid Accounts, and brute force techniques that guess passwords against exposed services such as SSH, RDP and web consoles.
Protocol weaknesses. Older protocols with no encryption or integrity protection, which let a network attacker watch or alter traffic. ATT&CK's adversary-in-the-middle technique abuses features of common protocols such as ARP and DNS, and its mitigations include disabling legacy protocols not needed in the environment and encrypting all traffic.
Unsupported systems. Devices no longer receiving updates carry their known flaws forever.
How are vulnerabilities scored?
The Common Vulnerability Scoring System captures the principal characteristics of a vulnerability and produces a numerical score reflecting severity, which can be translated into low, medium, high and critical to help organizations prioritize their vulnerability management. CVSS is currently at version 4.0 according to FIRST.
A score describes the flaw in general. It does not say whether the flaw is exposed in your network, whether someone is exploiting it, or what the device protects.
What tells you a flaw is urgent?
CISA maintains the Known Exploited Vulnerabilities catalog, which it describes as the authoritative source of vulnerabilities that have been exploited in the wild. A flaw on that list in a device reachable from the internet should move to the front of the queue regardless of its numeric score.
Add your own context. How exposed is the system: internet facing, internal, or isolated? What does it control? Is there a compensating control such as a firewall rule that blocks the vulnerable service? NIST SP 800-40 Rev. 4 describes enterprise patch management as identifying, prioritizing, acquiring, installing and verifying patches, and frames patching as preventive maintenance and a cost of doing business.
A constructed example
A scan reports two issues. One is a critical score flaw in a database server on an isolated back office network. The other is a medium score flaw in a VPN gateway facing the internet, which appears in the exploited catalog. The team patches the gateway first, since it is reachable by anyone and known to be used by attackers, and schedules the database for the normal maintenance window with a firewall rule limiting who can reach it.
How do you find them?
Maintain an inventory first. You cannot scan what you do not know exists. Then combine authenticated scans of internal systems, external scans of what the internet sees, configuration checks against a baseline and monitoring of vendor advisories for the products you own. Compare external scan results with your inventory: anything reachable that you did not list is a finding on its own.
How to check or apply this
- Keep an inventory of network devices, services and software versions.
- Scan externally and internally on a regular schedule, and after changes.
- Check findings against the CISA exploited vulnerabilities catalog.
- Rank by exposure, exploitation, asset value and compensating controls, then by score.
- Patch internet facing and exploited items first and set a target time.
- Remove default credentials, unused services and legacy protocols.
- Verify fixes with a rescan and record exceptions with an owner and expiry date.
Quick check
Is a high CVSS score always the top priority?
No. Score measures general severity. Exposure and active exploitation in your environment often matter more for ordering the work.
What if a device cannot be patched?
Isolate it, restrict who can reach it, monitor it closely and plan its replacement. Record the exception with an owner and an end date.
Sources
- FIRST, Common Vulnerability Scoring System
- CISA, Known Exploited Vulnerabilities Catalog
- NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning
- MITRE ATT&CK T1557, Adversary-in-the-Middle
- MITRE ATT&CK T1110, Brute Force
Last reviewed: 18 October 2026.
