What Is a Vulnerability? CVEs, Exploits, Zero-Days, and Patch Management

Every piece of software has vulnerabilities. Learn what CVEs are, how exploits work, what zero-day means, and why patch management is one of the most important security practices an organisation can have.

What Is a Vulnerability?

A vulnerability is a weakness or flaw in software, hardware, or a system configuration that can be exploited by an attacker to cause harm. Vulnerabilities exist in virtually every piece of software — including operating systems, web browsers, network equipment, and application code.

Vulnerabilities are not the same as bugs that only cause crashes or incorrect output — a vulnerability specifically enables a security consequence: unauthorised access, data theft, privilege escalation, or denial of service-attack-distributed-denial-of-service-explained).

CVE: Common Vulnerabilities and Exposures

CVE (Common Vulnerabilities and Exposures) is a standardised system for naming and cataloguing known vulnerabilities. Each vulnerability receives a unique identifier:

CVE-YEAR-NUMBER
CVE-2021-44228   ← Log4Shell (Apache Log4j vulnerability)
CVE-2017-0144    ← EternalBlue (SMB vulnerability used by WannaCry)
CVE-2014-0160    ← Heartbleed (OpenSSL vulnerability)

CVEs are maintained by MITRE Corporation and published in the NVD (National Vulnerability Database) by NIST. The NVD entry for each CVE includes a description, affected versions, and CVSS score.

CVSS: Common Vulnerability Scoring System

CVSS provides a numerical severity score (0.0 to 10.0) for each vulnerability, based on factors including:

| Category | Factors | |---|---| | Attack Vector | Network, adjacent, local, physical | | Attack Complexity | Low (easy), high (requires special conditions) | | Privileges Required | None, low, high | | User Interaction | None required, required | | Impact | Confidentiality, integrity, availability — none/low/high each |

Severity Levels

| CVSS Score | Severity | |---|---| | 0.1 to 3.9 | Low | | 4.0 to 6.9 | Medium | | 7.0 to 8.9 | High | | 9.0 to 10.0 | Critical |

A CVSS 10.0 vulnerability is network-exploitable, requires no authentication, needs no user interaction, and completely compromises all three security pillars (confidentiality, integrity, availability).

Log4Shell (CVE-2021-44228): CVSS 10.0. Remote code execution via a logging library used in millions of Java applications. Required no authentication, exploitable over the internet with a simple log message.

What Is an Exploit?

An exploit is a piece of code, tool, or technique that takes advantage of a vulnerability to achieve an attacker's goal. The relationship is:

Vulnerability  = the weakness that exists
Exploit        = the method that leverages the weakness
Payload        = what the exploit delivers (shell, ransomware, etc.)

Not all vulnerabilities have public exploits. An unpatched vulnerability without a public exploit is still dangerous — it may have a private exploit. But the presence of a public exploit dramatically increases the urgency to patch.

Exploit Frameworks

Metasploit is the most widely used exploit framework, used by both security professionals and attackers. It provides a library of exploits for known CVEs and automates the process of selecting, configuring, and launching them. Security teams use it for penetration testing to verify whether systems are actually exploitable.

Zero-Day Vulnerabilities

A zero-day (or 0-day) is a vulnerability that:

  1. Is unknown to the vendor — or known but not yet patched
  2. May already have an exploit being used in the wild

The term comes from "zero days" of warning — the vendor has had no time to release a patch. Zero-days are highly valuable: nation-state intelligence agencies, criminal groups, and brokers pay millions of dollars for reliable zero-days in widely used software.

Once a zero-day is disclosed (by researchers or because it is spotted being used in attacks), it becomes a "known vulnerability" and enters the CVE system. The vendor typically releases a patch, and organisations must apply it quickly before automated exploit kits incorporate it.

Responsible Disclosure

When a security researcher discovers a vulnerability, they face a choice:

  • Responsible disclosure (coordinated disclosure): Privately notify the vendor and give them time to patch (usually 90 days — Google Project Zero's standard) before going public
  • Full disclosure: Immediately release all details publicly, forcing the vendor's hand
  • bug bounty programs: Vendors pay researchers to responsibly disclose vulnerabilities through official programs (HackerOne, Bugcrowd, vendor programs)

Vulnerability Scanning

Organisations regularly scan their systems for known vulnerabilities using tools like:

  • Nessus (Tenable) — comprehensive network and system vulnerability scanner
  • OpenVAS — open source alternative
  • Qualys VMDR — cloud-based continuous scanning
  • Nikto — open source web server scanner

Scanners compare installed software versions against CVE databases and flag unpatched systems.

Patch Management

Patch management is the process of identifying, testing, and applying security patches to keep systems current. It is one of the highest-impact security practices — most successful attacks exploit known vulnerabilities that have patches available but have not been applied.

Patch Management Process

  1. Identify new patches (subscribe to vendor security bulletins and CVE feeds)
  2. Assess severity — CVSS score, exploitability, affected systems
  3. Test in non-production environment (verify patches do not break functionality)
  4. Deploy — roll out to production, starting with highest-risk systems
  5. Verify — confirm patches applied successfully

Patch Prioritisation

Not all patches can be applied instantly. Prioritise:

  • CVSS 9.0+ or active exploitation → Emergency patching (24-72 hours)
  • CVSS 7.0-8.9 → Accelerated patching (within 1-2 weeks)
  • CVSS 4.0-6.9 → Standard patching (within 30 days)
  • CVSS below 4.0 → Scheduled patching (next maintenance window)

Attack Surface Reduction

Every unnecessary service, open port-the-internets-core-protocol)-and-UDP-ports-explained), installed application, or user account is part of your attack surface — the set of points where an attacker could attempt exploitation. Reducing the attack surface limits exposure:

  • Uninstall software that is not in use
  • Disable services and close ports not required
  • Remove default accounts and credentials
  • Apply the principle of least privilege to all accounts

Summary

  • A vulnerability is a flaw that can be exploited to cause a security consequence
  • CVEs provide standardised identifiers; CVSS provides severity scores from 0 to 10
  • An exploit leverages a vulnerability; a zero-day is an unknown or unpatched vulnerability
  • Metasploit is the standard exploit framework used in security testing and real attacks
  • Patch management — rapidly applying security patches — is the most effective defence against known vulnerabilities
  • Responsible disclosure allows vendors time to patch before details become public