What is a CVE and how does vulnerability scoring work?
CVEs are the universal ID system for software flaws, and CVSS scores tell you how bad each one actually is.
A CVE (Common Vulnerabilities and Exposures) is a standardised identifier, like a serial number, assigned to a publicly known security flaw in software or hardware. CVSS (Common Vulnerability Scoring System) is the 0-to-10 scale used to rate how dangerous that flaw is. Together they let defenders, vendors, and patch tools speak the same language.
Who assigns CVE numbers and how?
CVE IDs are issued by organisations called CNAs (CVE Numbering Authorities), which MITRE coordinates on behalf of the broader CVE Program. Major vendors such as Microsoft, Google, and Apple are CNAs themselves, so they can self-assign IDs for flaws in their own products.
The format is always CVE-[year]-[sequence number], for example CVE-2021-44228, the Log4Shell flaw. The year reflects when the ID was reserved, not necessarily when the bug was found or fixed. Sequence numbers can run into five digits when a single year generates tens of thousands of entries.
What is CVSS and what does the score actually measure?
CVSS, maintained by FIRST (Forum of Incident Response and Security Teams), breaks a vulnerability down into measurable properties and outputs a number from 0.0 to 10.0. A higher number means more potential damage with less effort from an attacker.
The current version, CVSS v4.0, uses four metric groups: Base (the flaw's intrinsic properties), Threat (real-world exploit activity), Environmental (how your specific setup changes the risk), and Supplemental (contextual detail that does not change the score). Most advisories publish only the Base score, which is the starting point before your environment is factored in.
Base score components include Attack Vector (network vs. physical access required), Attack Complexity, privileges needed, and the impact on confidentiality, integrity, and availability. Each property has defined values that feed a formula. NIST publishes all scored entries in the National Vulnerability Database (NVD).
How do severity bands translate to urgency?
FIRST defines five qualitative severity ratings that map to score ranges. Treat Critical and High findings as patch-first candidates.
| Severity | CVSS Score Range | Typical meaning |
|---|---|---|
| None | 0.0 | No impact |
| Low | 0.1 to 3.9 | Limited scope, high barrier for attacker |
| Medium | 4.0 to 6.9 | Some conditions required, partial impact |
| High | 7.0 to 8.9 | Significant impact, easier to exploit |
| Critical | 9.0 to 10.0 | Remote, unauthenticated, full compromise possible |
Log4Shell scored a CVSS 10.0 because an unauthenticated attacker anywhere on the internet could run arbitrary code with no user interaction. That combination of zero barriers and maximum impact produces the ceiling score.
Does a high CVSS score mean I should panic right now?
Not automatically. CVSS Base scores measure theoretical severity, not active exploitation. A CVSS 9.8 flaw in software you do not run is less urgent than a CVSS 6.5 flaw being actively exploited in a tool you use every day.
CISA maintains a Known Exploited Vulnerabilities (KEV) catalog that tracks flaws with confirmed in-the-wild attacks. Cross-referencing NVD data with the KEV catalog gives a more realistic priority order than CVSS alone. Federal civilian agencies are required to patch KEV entries on a fixed schedule, and many private organisations follow the same discipline.
How does a vulnerability go from discovery to a CVE entry?
A researcher finds a flaw and reports it, either to the affected vendor (coordinated disclosure) or directly to a CNA. The CNA reserves a CVE ID and the vendor works on a fix. Once a patch ships, the vendor publishes a security advisory with the CVE number, affected versions, patched version string, and often the Base score.
NVD then enriches the entry with its own CVSS analysis, software identifiers called CPE (Common Platform Enumeration) strings, and reference links. Researchers who discover bugs are typically credited in the vendor advisory, which is why you will see names such as Alvaro Munoz or James Kettle attached to specific CVEs.
What does a patched version string tell me?
The patched version is the first release that contains the fix. If an advisory says "fixed in 3.4.2", any installation running 3.4.1 or earlier is still exposed. Comparing your installed version against the patched version is the fastest way to know whether you are vulnerable, and it is exactly what vulnerability scanners automate.
Vendors publish these strings in their advisories, for example Microsoft's Security Update Guide and Apple's security releases page. Always check the advisory directly rather than relying on a secondary summary.
Common questions
Can a CVE exist without a CVSS score?
Yes. A CVE ID can be reserved and published before NVD analysts have completed scoring. Entries in this state appear in the NVD as "awaiting analysis". Vendor advisories sometimes include a vendor-assigned score before NVD publishes its own.
Who decides the CVSS score, the vendor or the government?
Both can score the same CVE independently. Vendors often publish a score in their advisory, and NVD publishes a separate analysis. The two scores sometimes differ because analysts can weight the same properties differently, so always note which source a score comes from.
Is CVE the same as a zero-day?
No. A zero-day is a vulnerability being exploited before a patch exists. Once a CVE ID is assigned and a patch ships, the term zero-day no longer applies, though the CVE record and score remain. Some zero-days are assigned CVE IDs immediately; others receive an ID only after they become public.
