A third-party vulnerability is a security weakness in software, services, or systems supplied by an external vendor, partner, or managed service provider. It matters because your organization may depend on components you do not fully control, yet those components can still expose customer data, internal systems, or administrative interfaces.
In real attacks, criminals often exploit a supplier-side flaw, abused API, weak credential, or exposed integration point to move into the customer environment. That makes third-party risk a direct security issue, not just a procurement concern. Defenders reduce exposure by inventorying external dependencies, enforcing least privilege, isolating vendor access, patching and monitoring shared systems, and reviewing logs for unusual queries, exports, or authentication failures. Strong vendor oversight helps close the trust gap before an external weakness becomes an internal breach.