Define Vulnerability

---
title: Define Vulnerability
description: A vulnerability is a weakness or flaw in a software or hardware component that can be exploited by attackers to compromise confidentiality, integrity, or availability.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/threat-intelligence-security-center/define-vulnerability.html
release: australia
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 12
keywords: [define vulnerability, software weakness, CVE]
breadcrumb: [Vulnerability Artifacts, TISC Library Repository, Threat Intel Library, Use, Threat Intelligence Security Center, Security Operations]
---

# Define Vulnerability

A vulnerability is a weakness or flaw in a software or hardware component that can be exploited by attackers to compromise confidentiality, integrity, or availability.

## Before you begin

Role required: sn\_sec\_tisc.analyst

## Procedure

1.  Navigate to **Workspaces** > **Threat Intelligence Security Center**.

2.  Select **Threat Intel Library** icon on the workspace.

3.  Select **Vulnerability Artifacts** > **All Vulnerabilities**.

4.  Select **New**.

    **Note:**

    When you create a record for an observable, indicator, or object, a corresponding source record is automatically generated. A confirmation message is displayed to indicate that the new object record is created, and you’re then redirected to the aggregated record.

5.  On the form, fill in the fields.

<table id="table_h2f_q5q_myb"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Name

</td><td>

A name used to identify the Vulnerability.

</td></tr><tr><td>

Description

</td><td>

A description that provides more details and context about the vulnerability, potentially including its purpose and its key characteristics.

</td></tr><tr><td>

CVE ID

</td><td>

The Common Vulnerabilities and Exposures identifier for this vulnerability.

</td></tr><tr><td>

CVE Published Date

</td><td>

Indicates when the vulnerability is published. **Note:** This field can only be set if there is a CVE ID field value set.

</td></tr><tr><td>

CNA \(CVE Naming Authority\)

</td><td>

The CVE Naming Authority responsible for assigning the CVE ID.

</td></tr><tr><td>

CNA Last Modified

</td><td>

Indicates when the record was last modified.

</td></tr><tr><td>

Risk Rating

</td><td>

Indicates the normalized degree of severity of this vulnerability.-   Critical
-   High
-   Medium
-   Low


</td></tr><tr><td>

Vulnerability Class

</td><td>

The classification category identifies the type of vulnerability and serves as a reference field for organizing vulnerabilities.The available options for this field are managed in the `sn_sec_tisc_vulnerability_class` table, enabling you to define and maintain vulnerability class selections as required.

</td></tr><tr><td>

Threat Level

</td><td>

Threat level refers to the probability of a threat occurring. The purpose of this field is to help the security teams assess and prioritize the observables based on their importance and potential impact.**Note:** The value in this field is automatically populated only if the threat intelligence source supports the threat level. For example, if Threat Level = High \(then the threat occurrence is widespread and a persistent threat\).

</td></tr><tr><td>

Threat Severity

</td><td>

Threat severity refers to the impact that the threat would have if it did occur. The purpose of this field is to help the security teams assess and prioritize the observables based on their importance and potential impact.**Note:** The value in this field is automatically populated only if the threat intelligence source supports the threat severity. For example, if Threat Severity = Critical \(then it could cause immediate harm\).

</td></tr><tr><td>

TLP

</td><td>

TLP is used to confirm that sensitive information is shared with the appropriate audience.The following are the TLP values:

-   AMBER
-   AMBER+STRICT
-   CLEAR
-   GREEN
-   RED


</td></tr><tr><td>

Confidence

</td><td>

Enter the confidence for this observable record.The confidence property identifies the confidence that the creator has in the correctness of their data. The confidence value must be a number in the range of 0-100.

</td></tr><tr><td>

Affected Software

</td><td>

Lists the affected software associated with the vulnerability.

</td></tr><tr><td>

Severity

</td><td>

Indicates the normalized degree of severity of this vulnerability

</td></tr></tbody>
</table>    |Field|Description|
    |-----|-----------|
    |CVSS 2.0 Base Score|The CVSS v2.0 base score for this vulnerability.|
    |CVSS 3.x Base Score|The CVSS v3.0 / v3.1 base score for this vulnerability.|
    |CVSS 4.0 Base Score|The CVSS v4.0 base score for this vulnerability.|
    |CVSS 2.0 Vector|The CVSS v2.0 vector string representing the vulnerability characteristics.|
    |CVSS 3.x Vector|The CVSS v3.x vector string representing the vulnerability characteristics.|
    |CVSS 4.0 Vector|The CVSS v4.0 vector string representing the vulnerability characteristics.|
    |EPSS Score|Exploit Prediction Scoring System \(EPSS\) score indicating the probability of exploitation.|
    |EPSS Percentile|The percentile ranking of the EPSS score compared to all vulnerabilities.|

<table id="table_sbt_rlv_33c"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Is Zero Day

</td><td>

Indicates whether this is a zero-day vulnerability.

</td></tr><tr><td>

PoC exists

</td><td>

Indicates whether a Proof of Concept exploits exists.The following options are the options:

-   Yes
-   No
-   Unknown \(default\)


</td></tr><tr><td>

PoC State

</td><td>

The state or availability of the Proof of Concept exploits code. Following are the options:-   **Private**: PoC exists but isn’t publicly available and is held privately
-   **Vendor-only**: PoC is available only to the vendor for testing and remediation purposes
-   **Public**: PoC is publicly available and can be accessed by anyone
-   **Partial**: Only partial PoC code or information is available, not a complete working exploit
-   **Reliable**: PoC is proven to work reliably and consistently
-   **Automated**: PoC has been automated and can be executed with minimal manual intervention.


</td></tr><tr><td>

Exploitation Status

</td><td>

Indicates the exploit status that is associated with this vulnerability. Options are: -   Active Exploitation
-   Patched/Resolved
-   Exploit Available
-   Under Investigation


</td></tr><tr><td>

First Known Exploit Date

</td><td>

The date when exploitation of this vulnerability was first observed or reported. This field can only be set if **Exploitation Status** is set to one of the following options:

-   Active Exploitation
-   Exploit Available
-   Patched/Resolved


</td></tr><tr><td>

Exploit skill level

</td><td>

The technical skill level required to exploit this vulnerability. Options are:-   Novice
-   Intermediate
-   Expert


</td></tr><tr><td>

Exploit attack vector

</td><td>

The attack vector through which the vulnerability can be exploited. Options are:-   Remote
-   Local


</td></tr><tr><td>

Known Ransomware Campaign Use

</td><td>

Indicates if this vulnerability has been used in known ransomware campaigns.

</td></tr><tr><td>

KEV Date Added

</td><td>

The date this vulnerability was added to CISA's Known Exploited Vulnerabilities \(KEV\) catalog.

</td></tr><tr><td>

KEV Action Due Date

</td><td>

The due date for required actions as specified in the KEV catalog.

</td></tr><tr><td>

KEV Vendor Project

</td><td>

The vendor and project name associated with the KEV entry.

</td></tr><tr><td>

KEV Required Action

</td><td>

The required remediation action specified in the KEV catalog.

</td></tr><tr><td>

Dark Web Mentions

</td><td>

Information about mentions or discussions of this vulnerability on dark web forums.

</td></tr><tr><td>

Social Media Mentions

</td><td>

Information about mentions or discussions of this vulnerability on social media platforms.

</td></tr></tbody>
</table><table id="table_xtw_tcd_nyb"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Vulnerability Remediation Status

</td><td>

The current status of remediation efforts.The following are the options:

-   Open
-   In Review
-   Mitigated/Patched
-   Closed


</td></tr></tbody>
</table><table id="table_ytw_tcd_nyb"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Technical Details

</td><td>

Additional technical information about the vulnerability.

</td></tr><tr><td>

Additional Context

</td><td>

Add any additional context for this vulnerability.

</td></tr><tr><td>

Revoked

</td><td>

Indicates whether this vulnerability record has been revoked and is no longer considered valid or accurate.

</td></tr><tr><td>

Revoked Date

</td><td>

The date when this vulnerability record was revoked.**Note:** This field may be set only if the **Revoked** check box is selected.

</td></tr><tr><td>

Revoked Reason

</td><td>

The reason for the vulnerability record being revoked. **Note:** This field may be set only if the **Revoked** check box is selected.

</td></tr><tr><td>

Status

</td><td>

The current status of the vulnerability in TISC. Options are:-   Active \(default\)
-   Inactive


</td></tr><tr><td>

Expiration Time

</td><td>

The date and time when this vulnerability record will expire and should no longer be considered active.

</td></tr></tbody>
</table>6.  Select **Save**.

    After you save, a prompt message is displayed indicating that A new observable record is created. Select **Continue** to edit the record and create new relationships.

7.  Select **Continue**.

    you will be taken to the form view of the aggregated vulnerability record.

    **Important:**

    -   **Zero Day Status Toggle**: You can toggle the Zero Day status directly from the status pill in the header of the vulnerability record form. TISC supports zero-day vulnerabilities which are newly discovered security flaws without an assigned CVE identifier or remediation. These records may include an internal organizational identifier. As a zero-day vulnerability evolves, it can transition to a known CVE once an official identifier is assigned and remediation guidance is published.

        These records can include an internal organizational identifier. Over time, a zero-day vulnerability can transition to a known CVE after official identifier is assigned and remediation guidance is published.

        -   By default, fields such as **CVE ID** and **CVE Published Date** remain empty.
        -   An internal organizational identifier can be added in the **Identifiers** related records.
        -   To enable or disable zero-day status, use the **Zero-Day** toggle button on the vulnerability record page, which marks or unmarks the vulnerability as a zero-day.
        -   For manually created vulnerability source records, a dedicated **Zero Day field** is also available on the source record form.
    -   **Remediations Count**: The form includes a **Remediations Count** field, which indicates the total number of remediations linked to the vulnerability. To view or manage these remediations, go to the **Related Records** tab and select the **Remediations** section.
    -   **Prevent System Updates**: The form includes a Prevent System Updates check box. By selecting this option, you ensure that any updates made by analysts are retained, while system-generated updates are prevented.
    |Field|Description|
    |-----|-----------|
    |**TISC Tags**|
    |Select Tags|Select the tags that are associated with the vulnerability.|
    |Add Tags|Add new tags.|
    |Taxonomies|
    |Select Taxonomy|Select a Taxonomy that is associated with this vulnerability.|
    |Add Taxonomy Values|Add Taxonomy values that are associated with this vulnerability.|

    **Note:** **TISC Tags &amp; Taxonomies** appears after you save the vulnerability record. You can add tags and taxonomies for an existing record.

    Add TISC tags to a Vulnerability record from the list view:

    -   Select **Add TISC Tags** to associate the tags to the vulnerability record from the list view.
    -   Search and select the desired tag.
    -   Select **Submit** to add the tag.

        A confirmation displays indicating that the tags are applied successfully.

    Add Vulnerability record to a case from the list view:

    -   Select **Add to Case** to add the vulnerability record to a case.
    -   Select the case\(s\).
    -   Select **Add** to add the case to the vulnerability record.

        The record is added to case\(s\) successfully.

8.  If you want to delete any record then, select **Delete** to delete the aggregated record.

    When you select this action, then it will remove all the related records, except the original source data, and trigger re aggregation.

    **Note:**

    A confirmation message appears to verify that you want to delete the aggregated record. To also delete the associated source records and prevent re-aggregation, select the **Delete Source Records** check box. This action permanently removes all the related source records.


## What to do next

Use the **Related Records** section to view the detailed information about objects associated with the vulnerability. Select **Link** to link a record. The **Link** button may not apply to all the record types.

<table id="table_b5w_tcd_nyb"><thead><tr><th>

Related Record

</th><th>

Description

</th></tr></thead><tbody><tr><td>

MITRE Techniques

</td><td>

Lists the MITRE techniques related to this vulnerability.

</td></tr><tr><td>

Timeline Events

</td><td>

vulnerability.

</td></tr><tr><td>

Attack Patterns

</td><td>

List of attack patterns that are related to this vulnerability.

</td></tr><tr><td>

Campaigns

</td><td>

List the campaigns that are related to this vulnerability.

</td></tr><tr><td>

Courses of Action

</td><td>

Lists the courses of action related to this vulnerability.

</td></tr><tr><td>

Data Sources

</td><td>

Lists the data sources related to this vulnerability.

</td></tr><tr><td>

Data Components

</td><td>

Lists the data components related to this vulnerability.

</td></tr><tr><td>

Identities

</td><td>

Lists the identities that are related to this vulnerability.

</td></tr><tr><td>

Indicators

</td><td>

Lists the indicators that are related to this vulnerability.

</td></tr><tr><td>

Infrastructure

</td><td>

List the Infrastructure such as systems, software services, and any associated physical or virtual resources that are related to this vulnerability.

</td></tr><tr><td>

Intrusion Set

</td><td>

List the intrusion sets such as a set of adversarial behaviors and resources with common properties that are related to this vulnerability.

</td></tr><tr><td>

Locations

</td><td>

Lists the geographical locations associated with this vulnerability.

</td></tr><tr><td>

Malware

</td><td>

List the malware source records that are related to this vulnerability.

</td></tr><tr><td>

Malware Analysis

</td><td>

Lists the metadata and results of a particular static or dynamic analysis performed on a malware instance associated to this vulnerability.

</td></tr><tr><td>

Observables

</td><td>

List of observables related to this vulnerability.

</td></tr><tr><td>

Observed Data

</td><td>

Lists the observed data that are cyber security related entities such as files, systems, and networks and associated with this vulnerability.

</td></tr><tr><td>

Sightings

</td><td>

Lists sightings source records associated with this vulnerability.

</td></tr><tr><td>

Threat Actors

</td><td>

List the threat actors that are related to this vulnerability.

</td></tr><tr><td>

Threat Events

</td><td>

List the threat events that are related to this vulnerability.

</td></tr><tr><td>

Threat Groupings

</td><td>

Lists the threat groupings as objects that have a shared context with this vulnerability.

</td></tr><tr><td>

Threat Notes

</td><td>

Lists the threat notes that convey information to provide further context or analysis that are associated with this vulnerability.

</td></tr><tr><td>

Threat Opinions

</td><td>

Lists the threat opinions as an assessment of the accuracy of the information that are associated with this vulnerability.

</td></tr><tr><td>

Threat Reports

</td><td>

Lists the threat reports associated with this vulnerability.

</td></tr><tr><td>

Tools

</td><td>

Lists the tool associated with this vulnerability.

</td></tr><tr><td>

Vulnerabilities

</td><td>

If the observable is an IP address, this list shows any resources \(configuration items\) that have a matching IP address that are related to this vulnerability.

</td></tr><tr><td>

Vulnerability Attributes

</td><td>

Lists custom attributes and their qualitative or quantitative values associated with this vulnerability. Attributes provide additional metadata and characteristics specific to the vulnerability.Attributes can be configured in the `sn_sec_tisc_intel_attribute` table, allowing administrators to define and manage custom attributes.

</td></tr><tr><td>

CWEs

</td><td>

Lists the Common Weakness Enumeration \(CWE\) entries associated with this vulnerability. CWEs categorize software and hardware weaknesses that can lead to vulnerabilities.

</td></tr><tr><td>

Identifiers

</td><td>

Lists alternative identifiers for this vulnerability from various sources. Each identifier includes the identifier value and the organization that assigned it.

</td></tr><tr><td>

Vulnerability Products

</td><td>

Lists the software or hardware products affected by this vulnerability, along with their status \(e.g., known affected, fixed, under investigation, recommended\). This mapping helps identify which product versions are impacted.**Note:**

The **Vulnerability Products** related records section displays Vulnerability Product Mapping records instead of Product records.

Each entry represents a mapping between the vulnerability and a product, along with its current status.

</td></tr><tr><td>

Remediations

</td><td>

Lists available remediation actions for this vulnerability, including workarounds, mitigations, vendor fixes, and patches. Each remediation includes a description, type, prerequisites, and applicable products.

</td></tr><tr><td>

Vendor Comments

</td><td>

Lists comments and statements from vendors regarding this vulnerability. Each comment includes the vendor name, comment text, and the date the comment was made.

</td></tr><tr><td>

RSS Feeds

</td><td>

Lists the related RSS feeds that are associated with this vulnerability.

</td></tr><tr><td>

Related Cases

</td><td>

Lists the related cases that are associated with this vulnerability.

</td></tr><tr><td>

Related Case Tasks

</td><td>

Lists the related Case tasks that are associated with this vulnerability.

</td></tr><tr><td>

Related Canvases External References

</td><td>

List of external reference sources that provide additional details of the vulnerability.

</td></tr></tbody>
</table>**Related Records Actions**

Each related list supports specific actions based on how the records are associated with the vulnerability record.

-   Use **Add** and **Remove** when records are created from or deleted within the related list.
-   Use **Link** and **Unlink** when associating or disassociating existing records without creating new ones. For more information, see [Link Threat Intel Related Records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/link-threat-intel-releated-records.md).

    The available actions vary depending on the relationship type.

-   Use **New** to create a vulnerability artifact and link it to another artifact.
-   When you add a vulnerability identifier manually, a corresponding vulnerability source and vulnerability source identifier record are created automatically. Identifiers that were already recorded from other sources are retained.

-   The various SDOs in the Threat Intel Library contain potential relationships with other objects. To review and confirm these relationships, use the **Potential Relationships** link in the Threat Intel Library. For more information, see [Confirm object-object potential relationships](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/define-object-object-potential-relationships.md).
-   You can also confirm relationships from the object’s form view by using the **Related Records** section and selecting the available entries under **Potential Relationships**. For more information on see, [Confirm Potential Relationships from Related Records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/confirm-potential-relationships.md).
-   You can add objects to cases. For more information, see [Add to Case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/add-to-case.md).

**Parent Topic:**[Vulnerability Artifacts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/vulnerability.md)

**Related topics**  


[Access the Vulnerability Entities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/access-the-vulnerability-entities.md)

[Create a CWE record](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-create-cwe-record.md)

[Create a Product](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-create-product.md)

[Create a Vendor](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-add-vendor-to-vul.md)

[Create Remediations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-create-remediation-record.md)