A weakness that could be exploited by a threat. For example an open firewall port, a password that is never changed, or a flammable carpet. A missing control is also considered to be a vulnerability.