Vulnerability management

Vulnerability management is the "cyclical practice of identifying, classifying, prioritizing, remediating, and mitigating" software vulnerabilities,^[1] which is part of computer security and network security. It is a form of vulnerability assessment.

Process

Identification

Vulnerabilities can be discovered with a vulnerability scanner, which analyzes a computer system in search of known vulnerabilities,^[2] such as open ports, insecure software configurations, and susceptibility to malware infections. They may also be identified by consulting public sources, such as NVD, vendor specific security updates or subscribing to a commercial vulnerability alerting service.

Unknown vulnerabilities, such as a zero-day,^[2] may be found with fuzz testing. Fuzzing is a cornerstone technique where random or semi-random input data is fed to programs to detect unexpected behavior. Tools such as AFL (American Fuzzy Lop) and libFuzzer automate this process, making it faster and more efficient. Fuzzy testing can identify certain kinds of vulnerabilities, such as a buffer overflow with relevant test cases.

Similarly, static analysis tools analyze source code or binaries to identify potential vulnerabilities without executing the program. Symbolic execution, an advanced technique combining static and dynamic analysis, further aids in pinpointing vulnerabilities.^[3] Such analysis can be facilitated by test automation. In addition, antivirus software capable of heuristic analysis may discover undocumented malware if it finds software behaving suspiciously (such as attempting to overwrite a system file).

Classification and prioritization

Additionally, for vulnerability management, organizations use SCA/SBOM tools for third-party component checks, asset inventory systems, SIEM/SOAR, and risk prioritization platforms. Data sources include CVE for identifying publicly disclosed vulnerabilities, NVD and CVSS for technical severity scoring,^[4] CWE for classifying weakness types, OWASP Top 10 for web risks, CISA KEV for actively exploited vulnerabilities, and EPSS for predicting the probability of a CVE being exploited within the next 30 days.^[5]^[6]^[7]

Remediation and mitigation

Correcting vulnerabilities may involve the installation of a patch, a change in network security policy, reconfiguration of software, or educating users about social engineering.

References

↑ Foreman, Park (2010). Vulnerability management. Boca Raton: CRC Press. p. 1. ISBN 978-1-4398-0151-2. OCLC 444700438.
1 2 Anna-Maija Juuso and Ari Takanen Unknown Vulnerability Management, Codenomicon whitepaper, October 2010 Archived 2011-02-27 at the Wayback Machine.
↑ Nabel Zaharudin, Muhammad; Haziq Zuhaimi, Muhammad; Hossain Shezan, Faysal (19 May 2024), "Poster: Enhancing Symbolic Execution with LLMs for Vulnerability Detection" (PDF), IEEE Symposium on Security and Privacy, retrieved 2024-11-27
↑ Walkowski, Michał; Oko, Jacek; Sujecki, Sławomir (19 September 2021). "Vulnerability Management Models Using a Common Vulnerability Scoring System". Applied Sciences. 11 (18): 8735. doi:10.3390/app11188735.
↑ "NVD - Vulnerability Metrics". nvd.nist.gov. Retrieved 2026-05-31.
↑ "Known Exploited Vulnerabilities Catalog | CISA". www.cisa.gov. Retrieved 2026-05-31.
↑ "Advisory on Software Bill of Materials and Real-time Vulnerability Monitoring for Open-Source Software and Third-Party Dependencies | OWASP Foundation". owasp.org. Retrieved 2026-05-31.

External links

Implementing a Vulnerability Management Process SANS Institute.

[Foreman_2010_p._1-1] Foreman, Park (2010). Vulnerability management. Boca Raton: CRC Press. p. 1. ISBN 978-1-4398-0151-2. OCLC 444700438.

[Codenomicon-2] 1 2 Anna-Maija Juuso and Ari Takanen Unknown Vulnerability Management, Codenomicon whitepaper, October 2010 Archived 2011-02-27 at the Wayback Machine.

[3] Nabel Zaharudin, Muhammad; Haziq Zuhaimi, Muhammad; Hossain Shezan, Faysal (19 May 2024), "Poster: Enhancing Symbolic Execution with LLMs for Vulnerability Detection" (PDF), IEEE Symposium on Security and Privacy, retrieved 2024-11-27

[4] Walkowski, Michał; Oko, Jacek; Sujecki, Sławomir (19 September 2021). "Vulnerability Management Models Using a Common Vulnerability Scoring System". Applied Sciences. 11 (18): 8735. doi:10.3390/app11188735.

[5] "NVD - Vulnerability Metrics". nvd.nist.gov. Retrieved 2026-05-31.

[6] "Known Exploited Vulnerabilities Catalog | CISA". www.cisa.gov. Retrieved 2026-05-31.

[7] "Advisory on Software Bill of Materials and Real-time Vulnerability Monitoring for Open-Source Software and Third-Party Dependencies | OWASP Foundation". owasp.org. Retrieved 2026-05-31.

[1]

[2]

[3]

[4]

[5]

[6]

[7]

v t e Information security
Threats	Adware Advanced persistent threat Arbitrary code execution Backdoors Bombs Fork Logic Time Zip Hardware backdoors Code injection Crimeware Cross-site scripting Cross-site leaks DOM clobbering History sniffing Cryptojacking Botnets Data breach Drive-by download Browser Helper Objects Viruses Data scraping Denial-of-service attack Eavesdropping Email fraud Email spoofing Exploits Fraudulent dialers Hacktivism Infostealer Insecure direct object reference Keystroke loggers Malware Payload Phishing Voice Polymorphic engine Privilege escalation Ransomware Rootkits Scareware Shellcode Spamming Social engineering Spyware Software bugs Trojan horses Hardware Trojans Remote access trojans Vulnerability Web shells Wiper Worms SQL injection Rogue security software Zombie	vectorial version
Defenses	Application security Secure coding Secure by default Secure by design Misuse case Computer access control Authentication Multi-factor authentication Authorization Computer security software Antivirus software Security-focused operating system Data-centric security Software obfuscation Data masking Encryption Firewall Intrusion detection system Host-based intrusion detection system (HIDS) Anomaly detection Information security management Information risk management Security information and event management (SIEM) Runtime application self-protection Site isolation Scrubber Center
Related security topics	Computer security Automotive security Cybercrime Cybersex trafficking Computer fraud Cybergeddon Cyberterrorism Cyberwarfare Electronic warfare Information warfare Internet security Mobile security Network security Copy protection Digital rights management