Essentially, these are weaknesses within software or hardware that are usually known to attackers, but not yet fixed by Vendors. This can present major challenges for your environment’s security when they are exploited for malicious purposes, sometimes with little effort from the attacker and significant impact.