A remote, unauthenticated attacker is someone who can reach a target system over a network and try to exploit it without first proving who they are. In practice, that means no valid account, password, VPN session, or local access is required. If a service is exposed to the internet or another untrusted network, this attacker can often probe it directly for weaknesses.
This matters because unauthenticated remote attacks are usually high risk: they lower the barrier to entry and can be automated at scale. When a flaw allows code execution, device takeover, or data theft from an unauthenticated remote user, defenders cannot rely on access controls to block the first step. The main defenses are reducing exposure, patching vulnerable software, disabling unused services, segmenting networks, and replacing unsupported hardware that can no longer be updated.