What Is a CVE?
A CVE — Common Vulnerabilities and Exposures — is a unique public identifier for one specific
security vulnerability. When a flaw gets a CVE ID like CVE-2024-12345, everyone from the vendor
to your scanner to a news article can refer to the exact same issue by the exact same name. It
is the naming system that makes coordinated vulnerability management possible.
What does a CVE actually provide?#
A CVE entry is an identifier and a brief description — deliberately minimal. Its power is being a shared reference:
- A stable ID (
CVE-YEAR-NUMBER) that never changes. - A short description of the affected product and flaw.
- Links out to vendor advisories, patches, and analysis.
The CVE itself does not score severity or tell you how to fix it. That is layered on by other systems: CVSS scores rate severity, and the National Vulnerability Database enriches each CVE with metadata.
How does a CVE fit the patching workflow?#
| Step | Role of the CVE |
|---|---|
| Discovery | Researcher reports a flaw |
| Assignment | A CNA issues a CVE ID |
| Scoring | CVSS severity is attached |
| Advisory | Vendor publishes fix referencing the CVE |
| Remediation | Your scanner flags the CVE; you patch |
Because scanners and asset inventories speak in CVE IDs, the identifier is the thread that ties a public disclosure to the specific machines you need to patch — the backbone of vulnerability management.
CVEs are how the industry talks about specific weaknesses. Learn to read them in how to read a CVE and advisory. More at the Security Fundamentals hub.
Frequently asked questions#
What does a CVE ID look like and mean?
A CVE ID looks like CVE-2024-12345: the prefix, the year it was reserved, and a sequence number. It uniquely identifies one specific vulnerability in a specific product, so that vendors, scanners, and defenders all refer to the same issue by the same name instead of inventing their own labels.
Who assigns CVEs?
The CVE program, run by MITRE and funded by CISA, coordinates a network of CVE Numbering Authorities (CNAs) — vendors and organizations authorized to assign IDs for vulnerabilities in their scope. A researcher reports a flaw, a CNA validates and assigns a CVE, and it is published to the public list.