What is a CVE? Common Vulnerabilities and Exposures, defined for patch teams

Common Vulnerabilities and Exposures (CVE) is the program that gives each publicly disclosed cybersecurity vulnerability a single identifier and record, such as CVE-2015-3306. It is sponsored by CISA and run by MITRE, and scanners, vendor advisories and patch tickets all use the same ID, so every team knows it is talking about the same flaw.

How a CVE ID is assigned

The CVE Program states its mission as identifying, defining and cataloging publicly disclosed vulnerabilities, with one CVE Record for each. IDs come from CVE Numbering Authorities (CNAs): software vendors, open-source projects, coordination centers, bug bounty services or research groups authorized to assign IDs within an agreed scope.

A record moves through three states. It is Reserved while a CNA holds the ID, Published once the CNA adds a description and at least one public reference, and Rejected if it should no longer be used. A reserved ID in a vendor bulletin with no public detail is normal, not an error.

What CVE is not

A CVE is not a severity rating. The program lists that belief among its own myths, and severity arrives separately as a CVSS score. Nor is it the National Vulnerability Database (NVD): NIST's database is synchronized with the CVE List and adds impact metrics, product names and weakness data on top.

The description belongs to the CNA. NVD says on its detail page guide that it has no control over CVE descriptions, so a request to fix a vague description goes to the CVE Program, not to NIST.

What a patch desk does with it

The CVE ID is the join key. The NVD record for CVE-2015-3306, a ProFTPD file copy flaw, shows how much hangs off one ID: a CVSS vector, a weakness (CWE-284), affected product names, and a KEV entry dated 8 October 2026, more than eleven years after NVD published the record on 18 May 2015.

In practice: map every scanner finding to a CVE ID, deduplicate across tools by that ID, and check each one against the KEV catalog and its EPSS score before setting a due date. When a vendor advisory gives only its own bug number, find the CVE before the ticket is opened.

Where it appears on Daily CISO

Every row on must-patch and exploit lag is keyed by CVE ID. The security glossary places CVE beside CVSS, KEV and EPSS.

Related terms

Known Exploited Vulnerabilities (KEV) catalog, Common Vulnerability Scoring System (CVSS), Common Weakness Enumeration (CWE) and Common Platform Enumeration (CPE).