Network Vulnerabilities: The 15 Most Common and How to Find Them

Network vulnerabilities are weaknesses in the devices, services, protocols and configurations that connect your systems, and attackers use them to get in, move from host to host, and take data out. The common ones are not exotic: unpatched VPNs and firewalls, exposed management interfaces, remote access without MFA, default and reused credentials, Windows protocols that leak password hashes, and flat networks. Of the 15 below, only two are software flaws with a CVE number, and a vulnerability scan alone reliably catches fewer than half of them.

For each one, this guide covers what it gives an attacker, how to spot it being used, and the fix. To have them found for you, our external network penetration testing starts at $4,200 and internal network penetration testing at $6,000, fixed price, free retest included. See the external and internal network testing cost pages for what each size covers.

What is a network vulnerability?

NIST defines a vulnerability as a weakness in an information system, security procedures, internal controls or implementation that a threat source could exploit (NIST CSRC glossary). A network vulnerability is that weakness at the network layer: a router, firewall, VPN gateway or switch, a listening service, a protocol, or the way hosts trust each other.

A vulnerability is not a threat. Malware is the threat; the unpatched VPN it comes through is the vulnerability; the risk is how likely that is and what it would cost you (NIST CSRC glossary: risk). Our guide to threat vs vulnerability vs risk separates the three. Nor is a vulnerability always a bug: the ten misconfigurations NSA and CISA red and blue teams find most in large networks are almost all configuration and practice, from default settings and missing segmentation to weak MFA and poor credential hygiene (CISA advisory AA23-278A).

Types of vulnerabilities in network security

At the network layer, vulnerabilities fall into six broad types, and the type is a good guide to whether a scanner will catch it. People and physical access, such as a phished user or an unlocked comms room, are separate categories.

Type	Examples	Has a CVE?
Software flaws	Unpatched VPN, firewall or server; end-of-life systems	Yes
Misconfiguration and insecure defaults	Exposed admin panels, LLMNR on, SMB signing not required	No
Authentication and credential weaknesses	No MFA, default passwords, one local admin password everywhere	No
Insecure protocols	Telnet, FTP, SNMP v1 and v2c, TLS 1.0 and 1.1	Rarely
Architecture and design	Flat networks, backups reachable from the domain	No
Visibility gaps	Unknown assets, logs nobody collects	No

Network vulnerabilities at a glance

The 15 most common network security vulnerabilities, in the order an attacker meets them.

#	Vulnerability	Where	Scanner finds it?	What it gives an attacker
1	Unpatched edge devices	External	Usually	Code execution at the edge
2	Exposed management interfaces	External	Yes, if in scope	Control of the device
3	Remote access without strong MFA	External	No	A valid login
4	Internal services on the internet	External	Yes	Direct RDP, SMB, database access
5	Forgotten assets and dangling DNS	External	No	An unmonitored way in
6	Weak encryption, cleartext protocols	Both	Yes	Credentials in transit
7	LLMNR and NBT-NS poisoning	Internal	Only as informational	Password hashes
8	SMB signing not required	Internal	Yes	Logons as the victim
9	Unmanaged IPv6	Internal	No	Control of name resolution
10	Default credentials, SNMP strings	Internal	Partly	Device control, stored passwords
11	Poor credential hygiene, open shares	Internal	No	Reusable admin access
12	Kerberoastable service accounts	Internal	Partly	Service account passwords
13	AD Certificate Services flaws	Internal	No	A certificate as Domain Admin
14	Flat networks, failed segmentation	Internal	No	Reach to backups and critical servers
15	Unsupported systems, missed patches	Internal	Yes	Easy privilege escalation

A vulnerability scanner, credentialed inside and unauthenticated at the perimeter, flags six of the fifteen. The rest take a person who tries the login, listens on the wire, or follows one weakness to the next: the gap explained in penetration testing vs vulnerability scanning.

External network vulnerabilities

1. Unpatched edge devices

VPN gateways and firewalls are now the front door. Exploited software vulnerabilities were the initial access route in 31% of breaches in the Verizon 2026 DBIR, ahead of stolen passwords. Mandiant found exploits were the top infection vector for the sixth year running, at 32% of intrusions, and estimated that flaws were exploited on average seven days before a patch was available. It also noted that these appliances typically lack endpoint detection (M-Trends 2026). CISA’s advisory on Chinese state-sponsored intrusions names edge flaws used for initial access, including Ivanti Connect Secure (CVE-2024-21887) and Palo Alto PAN-OS GlobalProtect (CVE-2024-3400) (AA25-239A).

Fix: track the CISA Known Exploited Vulnerabilities catalog (more than 1,700 entries as of November 2026) and patch edge devices in days. After a critical advisory, run the vendor’s integrity check too, because a patch does not evict someone already inside.

2. Exposed management interfaces

Firewall and router admin panels, VPN consoles and out-of-band server controllers (iLO, iDRAC) reachable from anywhere. BOD 23-02 gives federal agencies 14 days to pull such interfaces off the internet or put them behind zero trust access. It binds only agencies, but it is the right benchmark.

Fix: manage devices only from the internal network, a jump host or a management network, with an allowlist.

3. Remote access without strong MFA

A VPN, remote desktop gateway or webmail login that accepts a password alone invites password spraying: one common password tried against many accounts, under the lockout threshold. The gap is usually not the main portal but the one beside it, such as a legacy VPN profile or an old authentication endpoint. Inside the network the same technique runs against Kerberos; our explainer on Kerbrute password spraying covers the Windows events it leaves.

Fix: MFA on every remote access path, phishing-resistant for administrators, with legacy authentication off.

4. Internal services on the internet

RDP, SMB, databases, SNMP and IPMI answering on public addresses, usually left by a temporary firewall rule or a loose cloud security group.

Fix: publish only what you mean to, and review rules on a schedule. Our guide to firewall penetration testing covers how rule sets are tested.

5. Forgotten assets and dangling DNS

Old staging servers, an acquired company’s IP ranges, and DNS records pointing at cloud resources you released, which someone else can claim. A scanner scans only the ranges you give it, so this surface stays invisible. See external attack surface management for keeping the inventory current.

Fix: inventory from DNS, certificate transparency and every cloud account; delete dangling records.

6. Weak encryption and cleartext protocols

Deprecated TLS 1.0 and 1.1, expired certificates, and cleartext Telnet, FTP, HTTP admin pages and SNMP v1 and v2c. On the perimeter this is usually medium severity; inside, cleartext admin protocols give credentials to anyone listening.

Fix: TLS 1.2 minimum, SSH and SFTP instead of Telnet and FTP, SNMPv3 with authentication and encryption. SSH needs patching like any other exposed service: the sshhole OpenSSH bypass is a current example, with steps to check your own hosts.

Internal network vulnerabilities

The internal test starts where items 1 to 3 leave an attacker: one ordinary user’s access. These decide whether that foothold stays small.

7. LLMNR and NBT-NS poisoning

When DNS cannot resolve a name, Windows asks the whole subnet. Anyone can answer, and the victim sends its NTLM authentication to the impostor, yielding hashes to crack or relay. Responder explained covers how testers demonstrate it.

Fix: where they are not needed, disable LLMNR by Group Policy and NetBIOS over TCP/IP through DHCP options or adapter settings, turn off mDNS where nothing uses it (poisoning tools answer it too), then confirm on sample hosts. The NSA and CISA misconfigurations advisory (AA23-278A) recommends disabling LLMNR and NetBIOS.

8. SMB signing not required (NTLM relay)

Relay forwards a victim’s authentication to another server and logs in as the victim. SMB signing stops relay to SMB, though not to LDAP or certificate web enrollment (item 13), and defaults have improved unevenly: Windows 11 24H2 Enterprise, Pro and Education require signing both ways, while Windows Server 2025 requires it only outbound (Microsoft Learn). Domain controllers have long required signing, but a new member file server can still accept unsigned sessions. Attackers can also force servers to authenticate to them, covered in PetitPotam and NTLM relay.

Fix: require SMB signing on clients and servers, LDAP signing and channel binding on domain controllers, and less NTLM.

9. Unmanaged IPv6

Windows prefers IPv6 and asks for an IPv6 configuration even on IPv4-only networks. If no legitimate server answers, a rogue host can, and make itself the subnet’s DNS server, steering logons into the relay in item 8.

Fix: DHCPv6 Guard and Router Advertisement Guard on access switches, or host firewall rules blocking inbound DHCPv6 and router advertisements where IPv6 is unused.

10. Default credentials and SNMP community strings

Printers, UPS units, switches, IPMI controllers and cameras still on factory passwords. CISA reports many devices compromised by state actors used well-known SNMP community strings such as “public” and “private” (AA25-239A). A printer admin panel often stores a directory or mail service account password.

Fix: change defaults at installation, use SNMPv3 only, and restrict SNMP to management hosts.

11. Poor credential hygiene and open shares

One local administrator password on every workstation from a shared image, and passwords in scripts, old Group Policy Preferences files and spreadsheets on shares everyone can read. Testers prove the reach with tools like NetExec, which tries one credential across every host. That reuse is what makes lateral movement fast.

Fix: unique local passwords through Windows LAPS, a sweep of shares and SYSVOL for stored credentials, and share permissions cut to need.

12. Kerberoastable service accounts

Any domain user can request a Kerberos ticket for an account with a service principal name, and part of it is encrypted with a key derived from that account’s password, so it can be cracked offline, where no lockout applies. Service accounts often have broad rights and old passwords. See our guide to Kerberoasting.

Fix: Microsoft recommends managed service accounts where possible, otherwise random passwords of at least 14 characters, AES with RC4 disabled, and removing unneeded service principal names (Microsoft Security).

13. AD Certificate Services misconfigurations

Templates that any domain user can enroll in and that let the requester name any user, and web enrollment that accepts relayed NTLM. Either can yield a certificate that logs in as Domain Admin and survives password resets. Certipy and AD CS attacks explains how testers find them.

Fix: per the NSA and CISA misconfigurations advisory (AA23-278A), disable web enrollment where unneeded (otherwise require HTTPS with Extended Protection), disable NTLM on certificate servers, remove the enrollee-supplies-subject flag from templates, and restrict template enrollment. Our Active Directory hardening checklist covers the rest.

14. Flat networks and failed segmentation

Workstations that reach domain controller admin ports, databases, backups or the cardholder data environment. This is what turns one infected laptop into company-wide ransomware (our guide to how ransomware attacks work traces that chain), and segmentation that exists only in the diagram is the common version. PCI DSS 11.4.5 requires it be tested where it reduces scope, which network segmentation testing covers.

Fix: segment by function, deny by default between zones, administer through jump hosts, and isolate backups from the domain.

15. Unsupported systems and missed internal patches

End-of-life Windows servers, SMBv1 on an old appliance, an HMI nobody may reboot. Internal patching usually lags the perimeter.

Fix: authenticated scanning, a dated replacement plan, and isolation for what cannot be patched.

Also check: monitoring gaps, wireless and cloud networks

These three sit outside the numbered list because they are not single findings, but a network assessment should cover each.

Monitoring gaps never show in a scan: insufficient internal monitoring is one of the ten on the NSA and CISA list. If a tester reaches Domain Admin and nothing alerts, that silence is worth knowing, and a red team is built to measure it.

Wireless deserves the same attention: a guest Wi-Fi that routes into the corporate network, a pre-shared key every former employee still knows, or laptops that join a look-alike access point because they never check the server certificate. Wall ports in lobbies and meeting rooms with no 802.1X are the same problem with a cable. The fix is a guest network with no route inside, WPA2- or WPA3-Enterprise with certificate validation enforced on clients, and 802.1X or port security on public-facing ports.

Cloud networks have the same weaknesses under different names:

On-premises item	Cloud equivalent	Fix
2 and 4: exposed management and internal services	Security groups or firewall rules open to 0.0.0.0/0 on SSH, RDP or database ports; databases and Kubernetes API servers with public endpoints	Default-deny inbound rules, private endpoints, admin access through a bastion or session manager
3: remote access without MFA	Cloud console and API access with a password or long-lived key alone	MFA on every human identity, short-lived credentials for workloads
4: data services on the internet	Storage buckets, snapshots or file shares readable by anyone	Account-level public access blocks; review every exception
5: forgotten assets	Unused public IPs, old load balancers, DNS records pointing at released resources	Inventory across every account and region; delete dangling records
14: flat networks	One large virtual network, or peering and transit rules that let every workload reach every other	Separate networks or accounts by function, deny by default between them, flow logs on

Scanning the address ranges you know about misses most of this, because the exposure is in configuration. A review of the rules themselves, by hand or with an infrastructure as code scanner, finds it.

How to detect these vulnerabilities being exploited

Event IDs are from the Windows Security log unless noted.

Technique	ATT&CK	Where to look	What it looks like
LLMNR and NBT-NS poisoning	T1557.001	Network sensor, UDP 5355, 5353 and 137	A non-DNS host answering name queries, or an answer to a decoy name
NTLM relay	T1557.001	Event ID 4624; NTLM operational log on DCs (8004, with auditing on)	NTLM network logons where workstation name and source address disagree
Kerberoasting	T1558.003	Event ID 4769 on DCs	RC4 tickets (type 0x17), or one account requesting many services quickly
Certificate abuse	T1649	Event IDs 4886 and 4887 on the CA (auditing on), checked against the CA database; 4768 on DCs	A certificate whose subject alternative name differs from the requester, or certificate logons by accounts that never use smart cards
Password spraying	T1110.003	VPN and IdP logs; Event IDs 4625 and 4771	Many accounts failing once or twice from one source
Edge device exploitation	T1190	Appliance logs sent off the device	New admin accounts, config changes, unexpected outbound traffic

How to prioritize network vulnerabilities

1. Exploited and exposed first. CISA’s BOD 26-04, issued June 10, 2026 to replace BOD 22-01 for federal agencies, sets deadlines from four questions, including whether the asset is publicly exposed. The fastest, three days plus forensic triage, covers KEV-listed flaws that give total control and are exposed or automatable. Risk-based vulnerability management shows how anyone can borrow the logic.
2. Then what chains. Poisoning, unsigned SMB and a shared local admin password each score medium; together they often reach Domain Admin. A finding on a proven path outranks a higher CVSS score that leads nowhere.
3. Then the rest by severity, retested to closure. To order a long backlog of CVEs that are not in KEV, add the EPSS score, FIRST’s daily estimate of the probability that a CVE will be exploited in the wild in the next 30 days, beside the CVSS score. See vulnerability remediation and our October 2026 KEV roundup.

How Invadel finds network vulnerabilities, and what it costs

What you need found	Engagement	Fixed price from
Missing patches, old systems, weak TLS, exposed services	Validated vulnerability scan	$1,500 up to 250 devices; $2,500 up to 1,000 (vulnerability scanning pricing)
Items 1 to 6	External network penetration test	$4,200 small; $6,800 medium; $8,400 large
Items 7 to 15, each step mapped to MITRE ATT&CK so your defenders see what should have alerted	Internal network penetration test	$6,000 for one site or domain; $9,200 medium
Active Directory paths only	Active Directory security assessment	$6,000 for one domain
Segmentation proof for PCI DSS 11.4.5	Network segmentation testing	$6,000 with an internal test
Wi-Fi	Wireless penetration testing	$3,800 for one NYC-metro office, up to 3 SSIDs (wireless penetration testing cost)
Whether your team detects and stops an attack	Red teaming	$12,500

External tests begin with discovery beyond the ranges you list, so forgotten hosts get tested. Most internal tests run remotely from a small appliance or virtual machine, usually starting from one standard domain user. Every price is fixed in writing from your scope with no sales call, onboarding starts within 24 hours of a signed proposal, and senior in-house testers do the work, no subcontractors. You get executive and technical reports, an attestation letter, the findings platform and a free retest. Size tiers are on the external network pricing and internal network pricing pages; read a sample report or total several tests in the price calculator.

Doing it in-house? Our network vulnerability assessment checklist covers the scan, the network penetration testing checklist covers the test, network security assessment explains the options between, and network penetration testing covers the whole engagement.

Frequently asked questions

What are the most common network security vulnerabilities? Unpatched VPNs and firewalls, exposed management interfaces, remote access without MFA, default credentials, LLMNR poisoning, SMB signing not required, shared local admin passwords, Kerberoastable service accounts and flat networks.

What are the types of vulnerabilities in network security? We group network-layer weaknesses into six: software flaws, misconfigurations, authentication and credential weaknesses, insecure protocols, architecture and design weaknesses, and visibility gaps. People and physical access are separate categories. Only software flaws reliably carry a CVE.

Can a vulnerability scanner find all network vulnerabilities? No. It finds missing patches, unsupported systems, weak TLS, exposed services and unsigned SMB. It does not try your VPN without MFA, poison name resolution, crack a service account or prove a segmentation gap.

Is malware a network vulnerability? No. Malware is a threat that uses a vulnerability, such as an unpatched gateway or an open share. Close the vulnerability and the path is gone for every strain.

What are common network vulnerabilities in cloud environments? Security groups open to the whole internet on SSH, RDP or database ports, storage and database endpoints left public, console and API access without MFA, forgotten public IPs and DNS records, and virtual networks where every workload can reach every other. They are configuration weaknesses, so a rule review finds more than a port scan.

Which network vulnerabilities do ransomware groups use most often? The entry points in items 1 to 4. CISA’s Akira advisory, for example, lists VPN services without multifactor authentication, known vulnerabilities, stolen credentials and external-facing services such as RDP. Once inside, credential reuse and flat networks (items 11 and 14) decide how far the attack spreads.

How often should we test for network vulnerabilities? Scan at least quarterly and after changes; penetration test at least annually and after major changes such as a new VPN, office or acquisition. Framework minimums are in our testing frequency guide.

How much does it cost to find network vulnerabilities? With us, a validated scan is $1,500 for up to 250 devices, an external network test starts at $4,200 and an internal test at $6,000, fixed in writing, with a free retest on every penetration test.

The short version

Most network vulnerabilities are configuration, credential and design weaknesses rather than software bugs, and a scanner finds fewer than half of them. Patch what is exploited and exposed first, then break the chains that lead to Domain Admin. Our network penetration testing services cover the perimeter and the inside at a fixed price with a free retest: scope your test and get the number the same day.