CVE (Common Vulnerabilities and Exposures)

What is a CVE?

A CVE, or Common Vulnerabilities and Exposures entry, is a unique identifier for a specific publicly known software weakness, formatted as CVE-YYYY-NNNNN. It is the shared catalog number of the security industry, letting every tool and team refer to the same flaw unambiguously.

Key takeaways

• A CVE is an identifier, not an assessment. It records that a weakness exists and has been catalogued. It says nothing about whether that weakness is exploitable in a given environment.
• Assignment takes time. Real, actively exploited compromises can exist for months before an identifier is issued.
• CVE-keyed tooling inherits that lag. If a pipeline begins at the moment a scanner reports a CVE, it is blind for the entire gap.
• A CWE is the flaw type; a CVE is the instance. SQL injection is a CWE. A specific SQL injection in a specific product version is a CVE.
• Volume is growing sharply. Which is why triage by identifier alone stopped working some time ago.

Why it matters

The 2025 Notepad++ supply-chain compromise was live and needed remediation for months before CVE-2025-15556 was assigned in early 2026. Anything keyed to identifiers was structurally unable to see it during that window, not because the tools were badly built but because the input they wait for did not yet exist. The identifier is the end of a coordination process, not the start of the risk.

The identifiers that do exist are also not a usable work queue. Exploitation of known vulnerabilities is now the leading initial-access vector in breaches at 31%, ahead of credential abuse for the first time, and median time to full remediation of entries on the CISA Known Exploited Vulnerabilities catalog has risen to 43 days, according to the Verizon 2026 Data Breach Investigations Report. The catalog is necessary and it is not sufficient.

How the system works

• Assignment. CVE Numbering Authorities, which include vendors, research organizations and coordination bodies, issue identifiers within their defined scope.
• Reservation. An identifier can be reserved before disclosure, which is why some records appear with little detail while coordination is still in progress.
• Publication. The record describes the affected product and version ranges and links to references, advisories and patches.
• Enrichment. Vulnerability databases add severity scoring, and separate feeds add exploitation signals such as exploit prediction scores and known-exploited status.
• Dispute and rejection. Records can be disputed by a vendor or rejected outright, so a published identifier is not permanently authoritative.

How a CVE relates to neighbouring identifiers

• CWE. The category of weakness, such as improper input validation. One CWE covers thousands of CVEs.
• CVSS. A severity score attached to a CVE, describing the properties of the flaw in the abstract rather than its impact in one environment.
• EPSS. A probability estimate that a given CVE will be exploited in the wild within a defined window.
• KEV. A list of CVEs with confirmed real-world exploitation, maintained by CISA. Membership settles the exploitation question.
• CPE and PURL. Product and package naming schemes that let a CVE record be matched to installed software and to dependency manifests.

What a CVE does not tell you

A CVE record does not say whether the vulnerable component is present in a runtime path, whether the host is listening on the required port, whether the vulnerable function is ever called, whether attacker-controlled data can reach it, whether an existing control already blocks the attack, or whether anyone owns the affected asset.

Every one of those is environment-specific, and together they determine whether a given identifier matters. This is why a CVE is best treated as an input to triage rather than the conclusion of it, and why two organizations can hold the same identifier at completely different urgency and both be correct.

How to use CVE data well

• Do not start the clock at scanner output. Correlate emerging-threat reporting against installed software so a compromise can be tracked before an identifier exists.
• Match on package coordinates, not product strings. Text matching against product names produces both false positives and silent misses across version ranges.
• Enrich before ranking. A CVE with exploitation evidence and a reachable code path is a different object from one with neither.
• Track the disputed and rejected states. Working a rejected record wastes remediation capacity and erodes trust in the queue.
• Cover the classes with no identifier. Misconfigurations, exposed credentials and identity weaknesses are frequently exploited and usually have no CVE at all.

Common misconceptions

• That every vulnerability gets a CVE. Many are fixed quietly by vendors, and misconfigurations and identity weaknesses generally have no identifier despite being exploitable.
• That a CVE number implies severity. The identifier carries no assessment. Severity arrives later, from a separate scoring process.
• That a high CVE count means an environment is insecure. Count correlates more strongly with how much an organization scans than with how exposed it is.
• That the year in the identifier is the disclosure year. It is the year the identifier was reserved, which can precede publication by a long interval.

Standards and sources

The CVE Program is operated by MITRE under CISA sponsorship, and the CNA Rules define who may assign identifiers and within what scope. Severity scoring and affected-configuration data are published in the NIST National Vulnerability Database, weakness classification uses the MITRE Common Weakness Enumeration, and exploitation signals come from the CISA Known Exploited Vulnerabilities catalog and the FIRST Exploit Prediction Scoring System.

FAQ

Are all vulnerabilities assigned a CVE? No. Many are fixed quietly by vendors, and misconfigurations and identity weaknesses generally have no identifier at all despite being exploitable.

How is a CVE different from a CWE? A CWE is the category of flaw. A CVE is one specific instance of that flaw in one specific product.

Does a high CVE count mean an environment is insecure? Not on its own. Count correlates more strongly with how much an organization scans than with how exposed it actually is.

Who can assign a CVE identifier? CVE Numbering Authorities, a set of vendors, research organizations and coordination bodies authorized to issue identifiers within a defined scope.

Sources

• CVE Program, CVE List and CNA Rules, 2026.
• NIST, National Vulnerability Database, 2026.
• MITRE, Common Weakness Enumeration (CWE) List, 2026.
• CISA, Known Exploited Vulnerabilities Catalog, 2026.
• FIRST, Exploit Prediction Scoring System (EPSS) Model, 2024.
• Verizon, 2026 Data Breach Investigations Report.