A set of conditions that violates an implied or explicit security policy. A product vulnerability is normally addressed by a Microsoft security bulletin or a service pack.