This term describes a vulnerability that an attacker can reach over a network and abuse without first logging in or presenting valid credentials. In practice, the target may be a web service, API, database listener, VPN portal, or other exposed network service. If the flaw is remotely exploitable, the attacker does not need local access; if it is without authentication, no account is required.
Security teams treat these issues as high priority because they lower the attacker’s work factor and are often usable at internet scale. Such flaws can lead to remote code execution, data theft, denial of service, or full system compromise. Defenses focus on rapid patching, reducing exposure with firewalls and access controls, disabling unnecessary services, and confirming which assets are actually reachable from untrusted networks. In vulnerability triage, this label usually means “fix first,” especially for public-facing systems.