What is a CVE? Meaning, CVSS and how to read a CVE number

Dozens of new vulnerabilities are published every day. Without a shared name, every vendor, scanner and researcher would call the same flaw something different, and nobody would know whether "the Citrix bug" your supplier mentions is the one in the CERT advisory. That is what CVE is for. This article explains how the system works, how to read a CVE number and its score, and how to decide which CVEs you patch this week and which can wait.

What exactly is a CVE?

CVE stands for Common Vulnerabilities and Exposures: a global register of publicly known vulnerabilities, each with a unique identifier and a short description. The programme has existed since 1999 and is run by MITRE. A CVE record says which vulnerability it is and in which product; it contains no score, no exploit and no fix instructions. That information comes from other sources that reference the same identifier: the vendor's advisory, NIST's National Vulnerability Database (NVD) with the CVSS score, ENISA's European Vulnerability Database (EUVD) and the advisories of national CERTs.

How do you read a CVE number?

A CVE identifier always has the same structure: CVE-YYYY-NNNNN.

• YYYY is the year the identifier was assigned or published. That is not necessarily the year the vulnerability was discovered or the software was written.
• NNNNN is a sequence number of at least four digits; since 2014 it can be five or more. The sequence number says nothing about severity.

Example: CVE-2026-35273 is a vulnerability in Oracle PeopleSoft published in 2026 and abused as a zero-day. What it meant and what to do about it, we described in Oracle PeopleSoft under active attack. The number itself only tells you: this is the vulnerability everyone is referring to.

CVE, CVSS and "actively exploited": three different things

Most confusion comes from three concepts being mixed up. Each answers a different question:

CVSS: the severity

The Common Vulnerability Scoring System gives a score from 0 to 10 based on, among other things, attack vector (over the internet or local only), complexity, privileges required and user interaction, and the impact on confidentiality, integrity and availability. The bands: low 0.1 to 3.9, medium 4.0 to 6.9, high 7.0 to 8.9 and critical 9.0 to 10.0. A 9.8 usually means: exploitable remotely, without logging in, with full takeover as a result. CVSS says nothing, however, about the chance that someone will try it on you.

Actively exploited: the urgency

Of the thousands of CVEs published each year, only a small share is actually exploited. That small group sets your priority. Three sources help: CISA's Known Exploited Vulnerabilities catalogue lists vulnerabilities with confirmed exploitation; EPSS (Exploit Prediction Scoring System) by FIRST estimates per CVE the probability of exploitation in the next thirty days; and the advisories of national CERTs, such as the Dutch NCSC, rate likelihood and impact per vulnerability. A medium-CVSS CVE under active exploitation on an internet-facing system comes before a critical CVE without known exploitation on an internal one.

Who assigns CVE numbers?

Not MITRE itself, but a network of CVE Numbering Authorities (CNAs): software vendors, research organisations, bug bounty platforms and national CERTs that may issue identifiers for their own products or scope. Above them sit "roots" that admit and support CNAs. For a long time that structure was almost entirely US-based and US-funded. Since November 2025 ENISA is a CVE Root for European organisations; by August 2026 twenty CNAs sat under that European umbrella.^[1] Europe now has its own entry point into the system and, with the EUVD, its own database.

Where do you look up a CVE?

• cve.org: the official register of the CVE Program, with the description, affected products and references.
• NVD (nvd.nist.gov): the US database that enriches CVEs with CVSS scores, weakness types (CWE) and product identifiers (CPE).
• EUVD (euvd.enisa.europa.eu): ENISA's European Vulnerability Database, operational since May 2025, with exploitation status and available patches per vulnerability, including reports received under the Cyber Resilience Act.^[2]
• National CERT advisories: a local assessment of likelihood and impact and what to do.
• The vendor's advisory: the only source with the exact affected versions and the patch.
• CISA KEV: whether the vulnerability is demonstrably being exploited.

Vulnerability scanners, EDR platforms and patch tools use the same identifiers, so a finding in your scanner links directly to the CERT advisory and the vendor patch.

Which CVE do you patch first?

Nobody can patch every CVE immediately, and nobody has to. A workable order:

1. Actively exploited and reachable from the internet: now, outside the patch window if necessary.
2. Actively exploited, internal only: this week, with compensating controls until then.
3. Critical or high CVSS, no known exploitation: in the regular patch window, externally reachable systems first.
4. Medium and low: bundled, based on business impact.
5. Not patchable (end-of-life, legacy, OT): isolate, monitor and document the residual risk.

That assessment is exactly what Continuous Vulnerability Management does for you on an ongoing basis: scan, prioritise on CVSS, EPSS and active exploitation, remediate and validate. And for vulnerabilities that have no CVE number yet because they live in your own application, there is no database; you only find those with a pentest.

CVEs and the law

Two European rules turn vulnerability management into an obligation. NIS2 and its national transpositions, such as the Dutch Cybersecurity Act in force since 15 August 2026, count "vulnerability handling and disclosure" among the duty-of-care measures for essential and important entities. And the Cyber Resilience Act requires manufacturers of products with digital elements, since 11 September 2026, to report actively exploited vulnerabilities in their products within 24 hours via ENISA's reporting platform. If you build software or devices yourself, you need a reporting process as well as a patch process.

Frequently asked questions

What is a CVE?

A CVE (Common Vulnerabilities and Exposures) is a unique identifier for one publicly known vulnerability in software or hardware, written as CVE-year-sequence, for example CVE-2026-35273. The identifier makes sure vendors, scanners, researchers and governments are talking about the same vulnerability.

How do you read a CVE number?

CVE-2026-35273: the year is the year the identifier was assigned or published, not necessarily the year the vulnerability was discovered. The sequence number has at least four digits and says nothing about severity. How serious a CVE is, you read from its CVSS score and from whether exploitation in the wild is known.

What is the difference between CVE and CVSS?

CVE is the name, CVSS the severity. CVSS (Common Vulnerability Scoring System) gives a score from 0 to 10: low (0.1 to 3.9), medium (4.0 to 6.9), high (7.0 to 8.9) and critical (9.0 to 10.0). A CVE gets its CVSS score from the vendor or from databases such as the NVD.

What does "actively exploited" mean?

That attackers are demonstrably using the vulnerability in real attacks. The US agency CISA maintains the Known Exploited Vulnerabilities catalogue for this, national CERTs such as the Dutch NCSC rate likelihood and impact in their advisories, and EPSS estimates the probability of exploitation in the next thirty days. An actively exploited CVE is patched first, whatever its CVSS score.

Where do I look up a CVE?

On cve.org (the MITRE-run CVE Program), in NIST's National Vulnerability Database for the CVSS score, in ENISA's European Vulnerability Database (EUVD), in your national CERT's advisories and in the vendor's own advisory. Vulnerability scanners link their findings to the same identifiers.

Who assigns CVE numbers?

CVE Numbering Authorities (CNAs): vendors, research organisations and CERTs allowed to issue identifiers for their own products or scope. MITRE runs the programme. Since November 2025 ENISA is a CVE Root for European organisations, so European CNAs sit under a European umbrella.

Do I have to patch every CVE?

No, you have to assess every relevant CVE and fix the dangerous ones first. Prioritise on active exploitation, exposure to the internet, CVSS and business impact; document compensating controls for what you cannot patch. Under NIS2 transpositions such as the Dutch Cybersecurity Act, vulnerability handling is part of the duty of care, and under the Cyber Resilience Act manufacturers must report actively exploited vulnerabilities in their products within 24 hours since 11 September 2026.

Sources

1. ENISA. ENISA scales up its role in the CVE Program.
2. ENISA. European Vulnerability Database (EUVD); MITRE, CVE Program; NIST, National Vulnerability Database; CISA, Known Exploited Vulnerabilities Catalog; FIRST, CVSS and EPSS; Dutch NCSC, Security advisories.