A residual vulnerability is a weakness that remains after a security control, patch, or mitigation has been applied. It does not mean the fix failed entirely; it means the organization has reduced risk, but some exposure still exists because no control is perfect, some systems are hard to replace, or a workaround only partially addresses the problem.
In cyber security, residual vulnerabilities matter because attackers often target what is left behind after the obvious defenses are installed. A firewall, patch, or configuration change may close one path while leaving another open through legacy software, misconfiguration, weak permissions, or incomplete remediation. Defenders track these gaps in risk registers and remediation plans so they can prioritize follow-up work, limit access to sensitive exposure data, and avoid treating “fixed” as the same as “fully safe.”