Affected systems are the devices, servers, endpoints, virtual machines, or managed environments that run a vulnerable product or version. If the software is present and exposed to the flaw, that system is considered affected until it is patched, removed, or otherwise mitigated. In practice, “affected” usually depends on the exact build, configuration, role, and sometimes the privileges under which the software runs.
This term matters because security teams need to know where risk actually exists. Attackers often look for affected systems to find easy entry points or to turn a local foothold into greater control, such as through privilege escalation. Defenders use asset inventories, version checks, and vulnerability scans to identify affected systems quickly, then prioritize patching, compensating controls, and monitoring. In other words, the real operational question is not just whether a bug exists, but which machines in the environment can be reached by it.