A configuration-sensitive flaw is a vulnerability that appears only when a product is set up in a particular way. The weakness may exist in one role, feature, protocol, or access mode, while the same software is safe in other configurations. That makes it different from a universal bug: the risk depends on how the system is deployed, not just on its version.
These flaws matter because attackers often look for the exact settings that unlock exposure, such as enabling a gateway feature, leaving an admin interface public, or using a legacy authentication path. Defenders must check both software builds and runtime configuration, especially on edge devices and identity systems. In practice, response includes inventorying affected roles, comparing enabled features against vendor guidance, and disabling unnecessary services before or after patching. A system can be fully updated and still remain vulnerable if the risky configuration is still active.