CVE

What it means

CVE is a public list of known software vulnerabilities in which each has a unique identifier and short description, such as CVE-2024-12345. Thanks to the shared label, vendors, security teams and tools all refer to the same flaw in the same way.

Severity is usually expressed as a CVSS score from 0 to 10, reflecting how easily the flaw can be exploited and how much damage it can do. Whether the flaw is already being actively exploited is tracked as well, and it often matters more than the score itself.

A vulnerability that attackers exploit before the vendor releases a fix is called a zero-day. Once a CVE and a patch are published, a race begins, because attackers often build tools for mass exploitation of unpatched systems within days.

How it works in practice

Companies use CVEs in patch management: scanners compare installed software with the vulnerability list and suggest what to update. Internet-facing systems such as VPN gateways, mail servers and web applications take priority.

In a penetration test, the tester lists the vulnerabilities found with their CVEs and recommendations. For management it helps to translate the technical list into risks: which system is exposed, what an attack would mean for operations and when it will be fixed.

Vendors and national CSIRTs publish alerts about critical CVEs. It is worth subscribing, especially for products the firm uses, and agreeing who in IT is responsible for assessing them, including while the administrator is on holiday.

What to watch out for

A high CVSS score does not automatically mean the firm is at risk, and a low score does not mean it is safe. Context decides: whether the vulnerable component is reachable from outside, whether it is used at all in that configuration and whether a public exploit exists.

Under the Cyber Resilience Act, makers of products with digital elements must handle vulnerabilities and report actively exploited flaws. When choosing software and devices, check how long the vendor promises to provide security updates.