Hcfyk

I am DM'ing a campaign called "Army of the Damned" based on Magic the Gathering: Innistrad in which a horde of zombies is attacking a town. In the 5e Monster Manual, zombies have poison immunity but no vulnerabilities. I incorrectly assumed prior that they had fire vulnerability and allowed my party to set up some flaming oil traps to deal with them. It would still work without the vulnerability, but it seems reasonable to me that they would be vulnerable to fire and possibly radiant.

How can I balance the zombie monster to be vulnerable to fire? What about adding radiant?

Alternately, as a DM, am I looking at this the wrong way?

To be clear, I am trying to maintain the CR of the zombies in question. I was not aware the DMG has a section on modifying monsters, as I have been reading it in tandem with my campaign, believing that my experience as a player would be enough to keep me from massively screwing up; that's held true so far. I will look into that tonight, but I would appreciate any experienced advice on how to do so. My second question still remains: should I really be doing this? What are the potential drawbacks?

Because it feels right to you and is thematic to your campaign, I would encourage you to stick by your ruling and keep the modified zombies. As a player, I find variant creatures fun, and ret-cons a little bit immersion-breaking.

Assuming all of your players have ready access to fire damage, that's an effective halving of the zombies' hit points. In the Creating a Monster section of Chapter 9, the DMG notes "Vulnerabilities don’t significantly affect a monster’s challenge rating, unless a monster has vulnerabilities to multiple damage types that are prevalent [...]" — and in my experience with customized monsters, when players know and are prepared for the vulnerability, that's exactly the noted "unless". So, in this case, the change would alter the effective CR, unless you do something to compensate.

One easy way to leave the appearance of fire vulnerability but keep the CR is to raise the monsters' actual hit points. Once your players realize that fire is the key, you can be sure they'll use fire whenever they can, which means the effective hit points are lower than the actual ones (as described in the DMG in "step 9" of Creating a Monster Stat Block). Exactly how much to adjust by is a judgment call. If the party is only sprinkling some fire into their attacks, going from, say, 22 to 33 might be right. If they've figured out some way to always attack with fire, go ahead and just double to 44. (This is still within the range of hit points for a CR ¼ creature.) If you want them to also be directly vulnerable to radiant damage, take that into account, of course.

Zombies' hit points are already on the low end for their CR, because Undead Fortitude keeps them up and lurching. (This isn't just presumption; from the Monster Features table, this is the equivalent of additional "effective hit points".) So, another approach would be to beef up that feature — perhaps make the save DC just "damage taken" rather than "5 + damage taken". But this is a less predictable than the raw HP approach, so I don't suggest it without some playtesting and tweaking. If you also want this feature to also be shut down by fire damage, that'd be a significant additional weakening — I'd be inclined to just leave it as it is. (As an aside, there should be an in-game way for the players to learn about this bit of non-obvious lore — it takes holy fire to really make a difference.)

You're overthinking it.

Zombies are goopy flesh, so there's no thematic reason for them to have a vulnerability to fire. They already have a radiant "vulnerability" (little 'v') baked into their Undead Fortitude ability.

If your issue is what to do with your players moving forward you can just tell them "guys I misread/misremembered and zombies aren't Vulnerable to fire". They should be understanding about it. That doesn't detract from the efficacy of their plan before. Fire still hurts and fire traps will still cause most things to have a bad day.

Vulnerability = weaker zombies

If you give them fire Vulnerability, it's going to make zombies less of a challenge. Period. I don't think it's a whole step from CR 1/4 down to CR 1/8 (see below)*, but fire damage is pretty easy to come by and your mileage may vary.

*I don't claim to be great at CR calculation, but a vulnerability does not denote an entire defensive CR step-down. Even if it did, it would only incur a total CR change of a half-step.