CVE
noun · also Common Vulnerabilities and Exposures · cve.org
The public catalog that gives each disclosed security vulnerability a unique identifier, such as CVE-2021-44228, so everyone refers to the same flaw.
CVE (Common Vulnerabilities and Exposures) is a naming system for publicly disclosed vulnerabilities. Each entry has an identifier in the format CVE-YEAR-NUMBER, a short description and references to advisories. The program is operated by MITRE with sponsorship from the U.S. Cybersecurity and Infrastructure Security Agency (CISA), and identifiers are assigned by a network of CVE Numbering Authorities, which include major software vendors and security organizations.
A CVE ID does not tell you how dangerous a flaw is or whether it is being exploited. That context comes from other sources: severity scores (CVSS), enrichment in databases such as NIST's National Vulnerability Database (NVD), and lists of actively exploited flaws such as CISA's Known Exploited Vulnerabilities catalog.
Example
In December 2021, a remote code execution flaw in the Apache Log4j logging library became known as Log4Shell and was assigned CVE-2021-44228. That single identifier let vendors, scanners, advisories and security teams around the world talk about exactly the same bug while they searched for every product that included the library.
Why it matters for a SOC analyst
CVE IDs are how you connect an alert, a vendor advisory, a scanner finding and a threat report. When an exploit attempt is detected, the matching CVE tells you which software is targeted and lets you check quickly whether your systems run a vulnerable version.
Related terms
- CVSS
An open standard from FIRST that rates the severity of a vulnerability from 0.0 to 10.0 based on how it can be exploited and what it affects.
- Vulnerability management
The continuous cycle of finding, prioritizing, fixing and verifying security weaknesses across an organization's systems and software.
- Patch management
Planning, testing and deploying software updates across an organization so known vulnerabilities are fixed quickly without breaking systems.
- Zero-day
A vulnerability that attackers exploit before the vendor has released a fix, so defenders have had zero days to patch it.