- Meaning
- A single, technically exploitable gap
- Identifier
- CVE ID, CVSS and EPSS score
- Detection
- Vulnerability scanner & SBOM comparison
- Treatment
- Patch SLA, hardening, workaround
- Related
- Vulnerability management, IoCs
- Updated
- June 2026
- Editorial team
- Compliance Compass
What is a vulnerability?
The term Vulnerability describes a single, technically exploitable gap – a buffer overflow, an unsafe deserialisation or an attackable dependency in a software library, for example. This page looks at the technical side: how a gap is identified, assessed and remedied across its life cycle. The wider organisational view – process, responsibility and audit evidence – is explained by the entry on Vulnerability management. Known gaps receive a unique CVE ID (Common Vulnerabilities and Exposures) and are graded for severity with a CVSS score from 0 to 10. In addition, the EPSS score estimates the probability that a gap is actually exploited – a valuable signal when setting priorities.
Scoring: CVE, CVSS and EPSS
The CVSS value describes the theoretical damage potential, but says nothing about whether a gap is being attacked in the wild. That is exactly where EPSS comes in: it forecasts the probability of exploitation over the next 30 days. If a gap also appears in the KEV catalogue (Known Exploited Vulnerabilities), it is demonstrably in use and belongs right at the top. Only the combination of severity (CVSS), probability (EPSS) and exposure of the system gives a technical prioritisation you can rely on.
Known gaps versus zero-days
For most catalogued CVEs a patch already exists – they stay dangerous only because the update is not applied. Zero-days are different: they are exploited before the vendor delivers a fix. For as long as no patch is available, only compensating measures count – virtual patching through a WAF rule, additional network filters, hardening of the configuration, or temporarily switching the affected service off.
The technical treatment process
Tooling automates the life cycle: vulnerability scanners and SCA tools compare systems, containers and dependencies continuously against CVE databases, and an SBOM (software bill of materials) is what makes vulnerable components visible in the first place. The finding then sets a patch SLA – a binding time window that follows criticality. Signs that exploitation is already under way come from Indicators of Compromise.
- Identification: scanner run, SBOM comparison and feed import (NVD, KEV, vendor advisories).
- Assessment: weigh CVSS severity together with EPSS probability and actual exposure.
- Treatment: apply the patch within the SLA, otherwise hardening or virtual patching as a workaround.
- Verification: run a re-scan that no longer reports the closed gap.
- Documentation: record the timestamp, the measure and the re-scan proof as evidence.
Patch SLAs in practice
Staged deadlines have proven their worth: critical gaps (CVSS 9.0–10.0) within 24 to 72 hours, high ones within seven days, medium ones within 30 days. An example: a vulnerability scanner reports CVE-2026-XXXX with CVSS 9.8 and a high EPSS value in a library of the publicly reachable customer portal. Because severity, probability and exposure coincide, the 24-hour SLA applies: the team installs an emergency update, checks the logs for IoCs and confirms by re-scan that the gap is closed – so no notifiable significant incident arises at all. This technical discipline is part of the risk management measures and of Cyber hygiene that Article 21 of NIS2 requires; the directive has applied since 18 October 2024.
Further reading: ENISA – the European Union Agency for Cybersecurity
Frequently asked questions
What is a vulnerability?
A vulnerability is a single, technically exploitable gap, such as a buffer overflow or an attackable dependency in a software library. Known gaps receive a unique CVE ID and are graded for severity with a CVSS score from 0 to 10. The complementary EPSS score estimates the probability that a gap is actually exploited. The governed process around all of this – roles, deadlines and audit evidence – is covered by the entry on vulnerability management.
What is a zero-day?
A zero-day is a vulnerability that is already being exploited before the vendor supplies a patch. For most catalogued CVEs a patch does exist. Because no security update is available for a zero-day, such gaps are particularly dangerous, and only compensating measures count: virtual patching through a WAF rule, additional network filters, hardening of the configuration, or temporarily switching the affected service off.
How are vulnerabilities managed?
Gaps are detected systematically, assessed against CVSS severity, EPSS probability and actual exposure, prioritised, and closed by patching or hardening. Staged patch deadlines have proven their worth: critical gaps within 24 to 72 hours, high ones within seven days, medium ones within 30 days. A re-scan then checks whether the fix worked and documents it as evidence for NIS2.