Glossary

Misconfiguration

What Is a Misconfiguration?

A misconfiguration is a settings or configuration error in software that creates security risk — exposed admin interfaces, overly permissive defaults, disabled hardening features, weak cryptographic choices — that exists not because of a code flaw but because of how the software was set up.

Misconfigurations are responsible for a large share of real-world breaches. They live in configuration files, container manifests, embedded scripts, and runtime defaults — all of which are typically invisible to source-code analysis and absent from vendor SBOMs. Binary composition analysis surfaces these alongside vulnerability findings because the configuration is part of what actually ships.

Vulnerabilities & RiskHarvest Now, Forge Later (HNFL)Harvest Now, Forge Later (HNFL) is an adversary strategy of collecting signatures and certificates today to forge them once quantum computing derives private keys.Read definition
Vulnerabilities & RiskCWE (Common Weakness Enumeration)A CWE (Common Weakness Enumeration) is a category of underlying software flaw — like buffer overflow or SQL injection — that can lead to vulnerabilities.Read definition
Vulnerabilities & RiskExploit Prediction Scoring System (EPSS)EPSS is a FIRST-maintained probabilistic score estimating the likelihood a CVE will be exploited in the wild within 30 days — prioritizing by real-world risk.Read definition

Misconfiguration

What Is a Misconfiguration?

Related Terms

Related Content