Weaknesses in software, hardware, or processes that attackers exploit to gain unauthorized access, emphasizing the need for regular security assessments and patch management.