LuxHawk.lu (+352) 27 52 67 45

← Back to knowledge

What is an IT security vulnerability?

Technical and IT 7 min Author : Arnaud Colin Updated : 06/10/2026

Summary

A cybersecurity vulnerability is a weakness in software, equipment, configuration or a process that may be exploited to affect a system or its data. A vulnerability is not yet an incident: the risk depends on factors such as exploitability, exposure and the importance of the affected assets. It should be recorded, assessed, remediated or mitigated, and then checked.

A vulnerability is a weakness, not an attack

A security vulnerability is a weakness that may be exploited. It can exist in unpatched software, obsolete equipment, a configuration, an authentication mechanism or an internal process. Vulnerability-Lookup, operated by CIRCL, illustrates the most visible part of the subject: publicly recorded technical vulnerabilities. Not every weakness receives a public identifier.

Three concepts should be separated. The vulnerability is the weakness. The threat is what may exploit it, such as an attacker or malicious software. The incident is the event that actually affects the confidentiality, integrity or availability of a system. This distinction prevents a newly discovered defect from being incorrectly described as a confirmed compromise.

Why do vulnerabilities have different priorities?

A technical severity score is not enough to make a decision. A critical vulnerability on an isolated, powered-off server may be less urgent than a lower-rated weakness on an Internet-facing service. Assessment should therefore consider known exploitation, exposure, obtainable privileges, the data processed and the possible effect on operations. The ENISA European Vulnerability Database and CIRCL’s service help establish what public information exists; they do not replace an assessment of the organisation’s own context.

How should an organisation respond?

The first step is to know which devices, applications and services are actually in use. Without an inventory, an organisation cannot determine whether an advisory applies to it. It should then monitor vendor and authority notices, test patches where operational risk requires it, deploy them according to a documented priority and verify the outcome. The ANSSI Cybersecurity Hygiene Guide notably recommends keeping components up to date, controlling accounts and protecting backups.

If a patch cannot be installed immediately, a compensating control may reduce exposure: disable a function, restrict access, isolate the device or increase monitoring. The temporary measure needs an owner and a deadline; it must not turn an indefinite delay into apparent remediation.

What should be checked afterwards?

Installing a patch does not automatically close the issue. Confirm that the expected version is active, that the service works and that there is no evidence of earlier exploitation. Logs can support this review: ANSSI explains that they can help both to detect an incident and to reconstruct it afterwards.

A case: a flaw at a third party, victims who had never installed it

On 31 May 2023, Progress Software published a critical advisory for MOVEit Transfer, a corporate file-transfer product. The flaw, referenced CVE-2023-34362, is an SQL injection: it lets an unauthenticated attacker reach the server’s database.

The joint FBI and CISA advisory of 7 June 2023 establishes that the CL0P group was already exploiting the flaw on 27 May, four days before the public announcement. The attackers dropped a component called LEMURLOOT to extract the hosted files, then demanded payment.

What matters to a Luxembourg SME is not MOVEit. It is that a large share of the affected organisations had never installed it. They were reached because a provider used it on their behalf: payroll bureau, accounting firm, insurer, business-software vendor. The staff file of a twenty-person company could sit on a server it did not know existed.

Three lessons follow, and none of them requires technical skill:

  • A flaw is also suffered by delegation. The perimeter to watch is not the machines you own, but the data you have entrusted.
  • The time to patch is counted in hours, not weeks. A few days passed between the advisory and mass exploitation. The FBI and CISA advisory puts it plainly: timely patching is one of the most efficient and cost-effective steps an organisation can take.
  • A flaw exploited before its publication exists. That does not excuse skipping the patch; it explains why detection and backups matter as much as the fix.

What an SME has to decide

The decisions below are not technical. They are taken at management level, written down, and given an owner.

  • Who receives security advisories, and at which address? An alert sent to a mailbox checked once a week is not an alert. In Luxembourg, CIRCL distributes these advisories free of charge.
  • What is the maximum accepted delay between a critical advisory and its fix? Writing “72 hours for anything exposed to the internet” is better than writing nothing. An unset deadline becomes an infinite one.
  • Who may decide to stop a service in order to patch it? Without that answer, the fix waits for the person who dares not interrupt production.
  • Which providers hold our data, and how do they warn us? This question belongs in the contract, not in the incident. It is what most MOVEit victims lacked.
  • What happens when a patch cannot be applied? The workaround must have an owner and an end date. Without a deadline, it becomes the normal state.

Sources

Links checked on 28 September 2026.

Continuous detection is explained in What is a SOC?. To understand what a network sensor can and cannot observe, read Cybersecurity probe: definition, purpose and limits.