Vulnerability

Vulnerabilities are found through testing, monitoring and coordinated disclosure, and each one is assessed for its effect on patient safety. Public identifiers such as CVE and scoring systems such as CVSS help track and rank them.

a weakness in an information system, system security procedure(s), internal control(s), human behavior, or implementation that could be exploited.

FDA guidance: Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026), Appendix 5, Terminology

A vulnerability is a weakness in an information system, system security procedures, internal controls, human behavior, or implementation that could be exploited by a threat.

FDA guidance: Postmarket Management of Cybersecurity in Medical Devices (December 2016), Section IV.K, Definitions