Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

What is a CVE? Common Vulnerabilities and Exposures

In one sentence: A CVE is a unique reference number, such as CVE-2023-34362, given to a publicly known security flaw so everyone can talk about the same problem.

What it is

The CVE Program’s stated mission is to identify, define and catalogue publicly disclosed cybersecurity vulnerabilities. Each entry gets an identifier in the form CVE, year, number, with a short description and references.

It is a naming system, not a score or a fix. When a scanner flags a flaw and a vendor patch note describes the same flaw, the CVE ID confirms they are talking about the same thing. MITRE says the programme was launched in 1999 and is sponsored by CISA and managed by the Homeland Security Systems Engineering and Development Institute, operated by MITRE.

How it works

  1. Someone finds a flaw: a researcher, vendor, customer or incident responder. Anyone can report one.
  2. The report goes to a CVE Numbering Authority (CNA), an organisation authorised to assign IDs within a defined scope, often its own products. MITRE says over 400 CNAs from 40 countries were producing records by October 2024.
  3. The CNA reserves an ID, then publishes a record with a description and references once the details are confirmed.
  4. Other databases build on the record. The US National Vulnerability Database, for example, adds a CVSS score and affected product data.
  5. Scanners, patch tools and advisories all use the ID, so teams can match findings without confusion.

A CVE record does not mean the flaw is being attacked, and a lack of a CVE does not mean software is safe.

Who it affects and how badly

Everyone who runs software, which is everyone. In practice the people who handle CVEs are IT managers, MSPs, auditors and developers.

Small firms meet CVE numbers in vendor emails and scan reports. Mid-sized firms use them to track patching across many products. Regulated firms, and anyone under Cyber Essentials, ISO 27001 or NIS2 style expectations, use them as evidence of a working vulnerability process. The EU also runs its own vulnerability database through ENISA, which the CVE Foundation notes it intends to work alongside.

The risk is false comfort. A long list of CVEs does not show which ones matter. You need an asset list and knowledge of which flaws are actually being attacked.

Real examples

CVE-2023-34362, MOVEit Transfer. CISA’s advisory describes the CL0P group exploiting this previously unknown SQL injection vulnerability from 27 May 2023, and notes CISA added it to the Known Exploited Vulnerabilities catalogue on 2 June 2023. The ID let defenders, vendors and regulators refer to one flaw. Source: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a

How to detect it

  • Run a vulnerability scan of your internet-facing systems and read the CVE IDs it reports.
  • In Microsoft 365, Microsoft Defender Vulnerability Management lists CVEs by device and software where you hold the licence. Intune and Windows Update reports show missing updates.
  • Search your asset list against new CVE IDs in vendor emails and the CISA KEV catalogue.
  • Subscribe to vendor security advisories for each product you run.
  • Check old and unmanaged systems, which often hold unpatched CVEs.

How to fix or prevent it

  1. Keep an accurate list of the software and devices you run.
  2. Read each CVE in context: is the product exposed to the internet, and is there evidence of exploitation?
  3. Patch the most urgent first. Use the KEV catalogue and the CVSS score together.
  4. Apply vendor updates within an agreed time. Cyber Essentials uses 14 days for critical and high-risk fixes.
  5. Where no patch exists, apply the vendor’s workaround or remove the system from the internet.
  6. Replace software that is no longer supported.
  7. Test your real exposure with a penetration test.

Related terms

Browse all entries in the vulnerabilities hub.

FAQ

What does CVE stand for? Common Vulnerabilities and Exposures.

Is a CVE the same as a CVSS score? No. A CVE identifies a flaw. CVSS rates how severe it is.

Who runs the CVE Program? MITRE says it is sponsored by CISA and managed by the Homeland Security Systems Engineering and Development Institute, operated by MITRE.

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan at wolfcore.co.uk/free-web-vulnerability-scan and see Wolfcore penetration testing.