Safety Center

What Is a CVE? IDs, Scores and Patching

A CVE is the name tag of a publicly known security weakness. This guide explains CVE IDs, CVSS scores and the CISA Known Exploited Vulnerabilities list — and how they combine into one practical question: should I patch this first?

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

The problem CVE solves

Before CVE, every vendor, researcher and news report named the same weakness differently, and defenders could not be sure they were talking about the same flaw. The CVE Program fixed that with a simple idea: one public identifier per vulnerability. When Equifax was breached in 2017, the weakness at the centre of it was CVE-2017-5638 — a critical flaw in the Apache Struts web framework — and anyone, anywhere, could look up that identifier and find the same weakness, the same patch, and the same advisories. That shared naming is the foundation of modern vulnerability management.

Anatomy of a CVE ID

A CVE ID has three parts: the prefix 'CVE', the year it was assigned or published, and a number. CVE-2017-5638 means: a vulnerability recorded in 2017, number 5638 for that year. The ID itself carries no severity information — it is a name, not a rating. The record behind it, in the CVE database and in the US National Vulnerability Database (NVD), describes the affected product and versions, the type of weakness, references to advisories and patches, and — once scored — the CVSS severity.

IDs are assigned by CVE Numbering Authorities (CNAs): organisations authorised to assign IDs within their scope. A software vendor is usually the CNA for its own products; large research organisations and coordinators also hold CNA status. This distributed model is why IDs appear quickly after a disclosure, and why the same weakness never gets two different IDs from two different reporters.

CVSS: the severity score, and its limits

CVSS, the Common Vulnerability Scoring System, scores a vulnerability from 0.0 to 10.0. The score is built from base metrics: how the weakness can be reached (network, adjacent, local, physical), how complex the attack is, whether privileges or user interaction are required, and what impact it has on confidentiality, integrity and availability. The resulting bands are familiar: 0.0 none, 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10.0 critical.

The score is useful and limited in the same way. It measures the severity of the weakness in the abstract, not the risk to your system. A critical vulnerability in a service you do not run is irrelevant to you; a medium vulnerability in your internet-facing server, actively exploited, is urgent. CVSS also does not measure whether anyone is actually exploiting the weakness — which is why defenders pair it with the KEV list and with their own knowledge of exposure.

CISA KEV: what attackers are actually using

The Known Exploited Vulnerabilities (KEV) catalog, run by CISA, lists vulnerabilities confirmed to have been exploited in the wild, with a due date for patching. For US federal civilian agencies those dates are binding; for everyone else, KEV is the strongest public signal available that a weakness has moved from theoretical to active. When a vulnerability appears on KEV, the question is no longer 'how bad could this be?' but 'attackers are using this now — are we exposed?'

This is why security teams triage in the order KEV first, then exposed-and-high-severity, then the rest. A defender with a thousand open CVEs cannot patch everything at once; KEV tells them where to start. Check the current KEV catalog on CISA's website — it changes regularly as new exploited vulnerabilities are confirmed. Last checked: 14 November 2026.

The workflow: CVE to CVSS to KEV to decision

1. Identify: a CVE ID appears in a scan, an advisory or a news report. Look up the record: what product, which versions, what weakness, is there a patch?
2. Score: read the CVSS score and the reasoning behind it, not just the number. Understand what the weakness allows an attacker to do.
3. Check KEV: is it on the CISA Known Exploited Vulnerabilities list? If yes, it jumps the queue.
4. Check exposure: do we run the affected product, is it reachable, what does it protect? An unexposed system buys time; an exposed one does not.
5. Decide — should I patch first? Patch first when the answer is: KEV-listed, exposed, and exploitable in your environment. Then work down by a combination of severity and exposure. Document the decision either way, so the reasoning survives the person who made it.

A worked example: CVE-2017-5638

CVE-2017-5638, the Apache Struts flaw behind the Equifax breach, scored critical (CVSS 10.0 in its original scoring). The patch was public from 7 March 2017. Equifax's vulnerable system was not patched, the weakness was exploited from May 2017, and data on about 147.9 million Americans was taken before the intrusion was discovered at the end of July. The lesson is not that the scoring failed — it scored the maximum — but that identification without action is worthless. The full case study is in our Equifax breach analysis.

Where to check a CVE

Check the public CVE record at cve.org, the detailed analysis at the US National Vulnerability Database (nvd.nist.gov), the vendor's own advisory for the patch, and the CISA KEV catalog for exploitation status. Use those sources in that order: the identifier, the detail, the fix, and the urgency. This site does not fetch live vulnerability data and does not publish live exploit information; the links above are the authoritative places to check. Last checked: 14 November 2026.

How a CVE record is created

A vulnerability is usually found by a researcher, a vendor, or an automated tool, and reported privately to the vendor or to a coordinator. The vendor or a CNA assigns a CVE ID, the weakness is confirmed and, ideally, fixed, and the record is published with a description, affected versions, and references. Sometimes the ID is assigned first and details follow later — the record can say 'reserved' while the disclosure is coordinated. Sometimes a vulnerability is disclosed publicly before a fix exists, which is why the timing of publication is itself a judgement call the researcher and vendor make together. The lesson for beginners: the CVE record is the end of a process, not the beginning. Behind every ID is a report, a fix, and a set of decisions about timing.

Common mistakes when using CVE data

• Treating the ID as a severity rating. The ID is a name. Severity comes from CVSS, urgency from KEV and exposure.
• Patching by score alone. A critical score on an unreachable system can wait; a medium score on an exposed, exploited system cannot.
• Trusting a scan count as a risk measure. A thousand open CVEs on systems that are patched, segmented or unreachable is a different risk from ten on your public-facing server. Count exposure, not totals.
• Using stale data. CVE records, CVSS scores and the KEV list all change. Check the current record on the day you decide, not a write-up from last year.
• Ignoring the vendor advisory. The advisory — not the CVE record — tells you exactly which versions are affected and which patch to apply. Read it before you act.

Sources

• CVE Program — CVE IDs and the CVE database (cve.org)
• US National Vulnerability Database (NVD)
• CISA — Known Exploited Vulnerabilities (KEV) catalog
• Research methodology — how this guide was researched

Last checked: 14 November 2026

Frequently asked questions

What is a CVE ID?

A CVE ID (for example CVE-2017-5638) is a unique identifier for a publicly disclosed cybersecurity vulnerability, assigned by the CVE Program so everyone — vendors, researchers, defenders — can refer to the same weakness unambiguously.

What does CVE stand for?

Common Vulnerabilities and Exposures. The CVE Program, operated by MITRE, maintains the list of CVE IDs and the public CVE database.

What is a CVSS score?

CVSS (Common Vulnerability Scoring System) is a standard way to score a vulnerability's severity from 0.0 to 10.0, based on factors such as how it can be exploited and what impact it has. Higher is more severe — but severity is not the same as urgency.

What is the CISA KEV list?

The Known Exploited Vulnerabilities (KEV) catalog, maintained by the US Cybersecurity and Infrastructure Security Agency (CISA), lists vulnerabilities that are confirmed to have been exploited in the wild. For US federal agencies it carries binding patch deadlines; for everyone else it is the best public signal of what attackers are actually using.

What is a CNA?

A CNA (CVE Numbering Authority) is an organisation authorised to assign CVE IDs for vulnerabilities in its own products or scope — for example, a vendor assigning IDs for its own software.

Should I patch the highest CVSS score first?

Not necessarily. Patch what is known to be exploited first (KEV), then what is exposed and reachable, then the rest by severity. A high score on a system nobody can reach matters less than a medium score on a system attackers are actively exploiting.