An adjacent attack vector means an attacker must be close to a target along a logical or physical network path to exploit a vulnerability. The target does not need to be reachable from the public internet; access may instead require being on the same local network, connected through a trusted segment, or otherwise positioned near the affected system.
This distinction helps defenders assess exposure: “not internet-reachable” does not mean “safe.” In real environments, an attacker may first obtain a valid account or gain access to an internal network, then exploit a vulnerable service nearby. Defenses include patching, limiting network paths to sensitive systems, enforcing least privilege, and monitoring internal accounts and activity.