A vulnerability evaluation apparatus, characterized by comprising: an input unit configured to input a source code of a program which is to be evaluated, information indicating assets which are desired to be preserved and an attack accomplishment condition which is a condition of the assets which are desired to be preserved not being preserved, information indicating an attack determination position which is a position at which it can be determined whether the condition where the assets which are desired to be preserved are not preserved is satisfied, and input information for the program, which are indicated in the source code; an input position designating unit configured to designate an input position indicating a position at which the input information for the program is input in the source code; an attack determination position designating unit configured to designate the attack determination position at which it can be determined whether the condition where the assets which are desired to be preserved are not preserved is satisfied, in the source code from the information indicating the attack determination position; and an attack path analyzing unit configured to analyze a path from the attack determination position to the input position in the source code and specify an attack path which is a path for which the attack accomplishment condition is satisfied from the path through specific processing at the attack determination position, wherein the specific processing includes at least one of processing of rewriting the assets which are desired to be preserved, or processing of making the assets which are desired to be preserved accessible from outside of an electronic apparatus at which the program is implemented. an input unit configured to input a source code of a program which is to be evaluated, information indicating assets which are desired to be preserved and an attack accomplishment condition which is a condition of the assets which are desired to be preserved not being preserved, information indicating an attack determination position which is a position at which it can be determined whether the condition where the assets which are desired to be preserved are not preserved is satisfied, and input information for the program, which are indicated in the source code; an input position designating unit configured to designate an input position indicating a position at which the input information for the program is input in the source code; an attack determination position designating unit configured to designate the attack determination position at which it can be determined whether the condition where the assets which are desired to be preserved are not preserved is satisfied, in the source code from the information indicating the attack determination position; and an attack path analyzing unit configured to analyze a path from the attack determination position to the input position in the source code and specify an attack path which is a path for which the attack accomplishment condition is satisfied from the path through specific processing at the attack determination position, wherein the specific processing includes at least one of processing of rewriting the assets which are desired to be preserved, or processing of making the assets which are desired to be preserved accessible from outside of an electronic apparatus at which the program is implemented.