By definition a vulnerability is a weakness in software systems, be it web applications, the network daemon service running over a port or a thick application as a binary. A weakness could be taken advantage of using ex-filtration mechanisms - the primary reason to this could be two:
- Extract data which is highly sensitive
- Elevate furthermore privileges on top of what is already affected
An Exploit facilitates both of these factors. Hence, by definition an exploit or a exploit code should be an amplifier to an existing vulnerability on systems or set of different kind(s) of system(s).
If a vulnerability is detected during a lexical analysis which might be due to a source code security audit, a reproduction of the which attempts to either get you access to special data or otherwise grant elevated privileges fails, it doesn't mean there would be no vulnerability but what it does mean that there were no exploits readily available which can grant you any of these.
What could it grant?
- May be chaining multiple vulnerabilities including the particular discovered vulnerability would
- It might as well be that the vulnerability doesn't affect all systems but a specific instance depending on a platform it is hosted on or other dependencies?
- The vulnerability is identified & advisories are released but previously it were a 0day which were sold off to the affected vendor which later never disclosed a potential full fledged step-by-step exploit code or any documentation of how a particular 'trigger' factor of the vulnerability would work.
To answer your question,
- Vulnerabilities could be considered as a risk factor without a doubt.
- Vulnerability does not always end up with exploitation or a working exploit availability.
- Some Vulnerabilities are always exploitable depending the right chaining is done or otherwise the undisclosed working exploit code is released. This again depends on the vendor disclosing party.
- Vulnerabilities are system weaknesses. It could lead to critical, high, moderate, low, or informational instances depending on how much sensitive data were leaked, how high elevated privileges were obtained.
Other factors might exist including but not limited to that of if the vulnerability could be chained to another potential vulnerability which happen to exist on the same system or set of system(s) affecting the CIA triad of security & hence compromising compliance factor.