Types of vulnerability: software, configuration, network, hardware, cloud and human
In short: A vulnerability is any weakness an attacker could use. They come from software bugs, operating systems, unsafe configuration, exposed network services, hardware and firmware, cloud settings and human or process gaps. Knowing the types helps you choose the right way to find each one.
What counts as a vulnerability?
A vulnerability is a weakness that a threat could use to cause harm. Many people think only of software bugs with CVE numbers, but a default password, an open file share or a missing leaver process can be just as dangerous. Grouping vulnerabilities by where they come from helps you see which ones your tools will find and which need other methods, such as reviews or audits. The difference between threat, vulnerability and risk is covered in what is cyber security.
The main types
| Type | Examples | How you usually find it |
|---|---|---|
| Software | Buffer overflows, injection flaws, flaws in third-party libraries | Vulnerability scanners, code scanning, dependency checks |
| Operating system | Privilege escalation bugs, vulnerable services | Authenticated or agent scans, patch reports |
| Configuration | Default passwords, guest accounts, weak TLS settings, admin rights for all | Configuration audits against benchmarks |
| Network | Exposed remote desktop, unencrypted protocols such as Telnet, flat networks | Network scans, firewall rule reviews |
| Hardware and firmware | Outdated router firmware, CPU side-channel flaws, unsupported devices | Asset inventory, vendor advisories, firmware checks |
| Cloud | Public storage buckets, over-permissive roles, missing logging | Cloud security posture management (CSPM) tools |
| People and process | Phishing susceptibility, no leaver process, untested backups | Audits, phishing simulations, tabletop exercises |
Zero-days, n-days and end-of-life software
- A zero-day is a flaw attackers exploit before the vendor has a fix. You cannot patch it, so you rely on reducing exposure, monitoring and temporary mitigations from the vendor.
- An n-day is a known flaw with a fix available that has not yet been applied. Most real attacks use these, which is why patch management matters so much.
- End-of-life software no longer receives security updates. Every new flaw found in it stays open for ever, so replacing or isolating it is the only lasting fix.
Why the type changes the fix
A software flaw is fixed by an update from the vendor. A configuration flaw is fixed by you, often in minutes, but it will come back unless the secure setting becomes the standard build. A process gap needs an owner and a changed procedure, not a tool. When you report findings, saying which type each one is helps the right team pick it up and stops the same problem returning.
Vendors and national agencies publish advisories for new flaws, and many organisations subscribe to them for the products they run. An accurate asset and software inventory is what makes these advisories useful: you can answer "do we run this?" in minutes rather than days.
Tip: scanners are best at software and OS flaws. Do not assume a clean scan means no configuration, cloud or process weaknesses.
Real-world example: a veterinary practice
A fictional veterinary practice runs a vulnerability scan and is pleased to see only a few medium findings. A short review by its IT supplier then finds three issues the scan did not flag as serious: the X-ray workstation runs an operating system that reached end of life years ago, the practice management software uses a shared login for all vets, and the backup drive is plugged in permanently. None has a CVE number, yet each could turn a minor incident into a disaster. The practice isolates the X-ray PC on its own network segment, sets up individual logins and rotates the backup drive offline.
Practice
Is a default administrator password a vulnerability even though it has no CVE?
What is the difference between a zero-day and an n-day?
Why might a clean vulnerability scan give false comfort?
Key takeaways
- Vulnerabilities come from software, OS, configuration, network, hardware, cloud and people.
- Many serious weaknesses have no CVE number.
- Zero-days have no fix yet; n-days are known flaws still unpatched.
- End-of-life software must be replaced or isolated.
- The type of vulnerability decides who fixes it and how.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.