What Is a CVE? Common Vulnerabilities and Exposures Explained

Every year, the security industry gives tens of thousands of software flaws a name. In 2025 it named 48,185 of them — up roughly 21% from the year before, according to published CVE data. That naming system is the CVE (Common Vulnerabilities and Exposures) program, and it is the shared vocabulary that lets a researcher in one country, a vendor in another, and a defender at your company all talk about the exact same bug. This guide explains what a CVE is, how vulnerabilities get disclosed, how they are scored, and why the plumbing behind all of it wobbled in 2025.

What Is a CVE?

A CVE (Common Vulnerabilities and Exposures) is a unique, public identifier assigned to a specific known security vulnerability in software, firmware, or hardware. Each CVE record gives one flaw a standard name — such as CVE-2024-3094 — so that security tools, advisories, and databases worldwide can reference the same issue unambiguously instead of inventing their own labels.

The distinction that trips people up: a CVE is an identifier, not a severity rating and not a patch. It is a catalog entry. It says “this particular weakness exists and here is its official reference number.” Everything else — how dangerous it is, whether it is being exploited, how to fix it — is layered on top by other systems described below. If you are new to the underlying concept, start with our explainer on what a vulnerability is in cybersecurity.

The Anatomy of a CVE ID

Every CVE follows the format CVE-YYYY-NNNN: the literal prefix “CVE,” the four-digit year the ID was reserved, and a sequential number. That number is not fixed at four digits. The scheme was expanded in 2014 so the sequence can grow arbitrarily long — CVE-2025-0001 or CVE-2025-141238 are both valid — precisely because the old four-digit cap of 9,999 per year is now blown through many times over. The year in the ID reflects when the identifier was assigned, which is not always the year the flaw was found or disclosed.

Who Runs the CVE Program: MITRE, CISA, and the CNAs

The CVE Program was launched in 1999 by the MITRE Corporation, a US non-profit, and MITRE still operates it as the program’s secretariat. It is funded by the US government through the Cybersecurity and Infrastructure Security Agency (CISA), part of the Department of Homeland Security. Day-to-day, the program is federated: MITRE does not personally vet every bug. Instead it delegates identifier assignment to a global network of CVE Numbering Authorities (CNAs) — over 450 organizations, including Microsoft, Google, Apple, Red Hat, and many others, each authorized to assign CVE IDs for vulnerabilities in their own products or scope.

That federated model is why the system scales to 48,000 records a year. It is also why 2025 was a scare. In April 2025, MITRE warned that its contract to operate the CVE Program was about to expire, raising the prospect that new CVE assignments could stall. CISA executed an eleven-month contract extension at the last minute, and funding has since been secured to keep the program running. The episode prompted a group of board members to spin up an independent, non-profit CVE Foundation as a hedge against future single-point-of-failure funding — a reminder that the world’s vulnerability catalog rests on a government contract that has to be renewed.

How Vulnerability Disclosure Actually Works

Getting a CVE assigned is only one step in a longer social process: deciding how and when to tell the world about a flaw. There are three broad philosophies, and the difference between them is mostly about who learns what, and when.

Coordinated disclosure (often called responsible disclosure) is the mainstream norm. The finder reports the flaw privately to the vendor or a CNA, gives them a window to build and ship a fix — commonly around 90 days — and only then are details published, ideally alongside a patch. Full disclosure is the opposite instinct: publish everything immediately, on the theory that public pressure forces vendors to act and that defenders deserve the same information attackers can independently find. Non-disclosure is the third path, where a flaw is kept secret — by a government, a broker, or an attacker — and becomes the raw material for a zero-day, a vulnerability exploited before any fix exists.

The tension is real. Disclose too early and you hand attackers a blueprint before defenders can patch. Disclose too late, or never, and organizations stay exposed to a flaw someone else may already be exploiting. The lifecycle diagram above shows why the window between public disclosure and patching is the dangerous part: once a fix is out, attackers reverse-engineer it to build an exploit, and the clock starts.

CVSS: Scoring a Vulnerability’s Severity

A CVE tells you a flaw exists; it does not tell you how much to worry. That job belongs to the Common Vulnerability Scoring System (CVSS), maintained by FIRST (the Forum of Incident Response and Security Teams). CVSS produces a number from 0.0 to 10.0 based on factors like attack vector, complexity, required privileges, and impact on confidentiality, integrity, and availability. Those numbers map to qualitative bands: 0.1–3.9 Low, 4.0–6.9 Medium, 7.0–8.9 High, and 9.0–10.0 Critical.

The current version, CVSS v4.0, was released by FIRST in late 2023 to sharpen scoring and reduce the long-standing habit of treating the base score as the whole story. It isn’t. A CVSS base score measures theoretical severity in a vacuum; it says nothing about whether a flaw is actually being exploited or whether it even reaches your environment. That gap is exactly why the two systems in the next section exist.

The NVD Backlog, EPSS, and CISA KEV

For years, the National Vulnerability Database (NVD) — run by the US National Institute of Standards and Technology (NIST) — was the place CVEs got “enriched” with CVSS scores, weakness types, and affected-product data. Then the pipeline broke. Starting in early 2024, NIST fell badly behind: submissions surged while enrichment slowed, leaving a growing backlog of CVEs sitting unscored. In April 2026 NIST effectively conceded the point, announcing it would no longer try to enrich everything: it will prioritize the highest-risk CVEs — those in CISA’s exploited-vulnerabilities catalog, affecting federal or critical software — and will not go back to enrich most records published before March 1, 2026. All CVEs still get added; most just won’t get a NIST-assigned score.

That shift makes two other systems essential rather than optional. EPSS (the Exploit Prediction Scoring System), also from FIRST, estimates the probability that a given CVE will be exploited in the wild in the next 30 days — a forward-looking complement to CVSS’s static severity. And CISA’s Known Exploited Vulnerabilities (KEV) catalog is a curated, authoritative list of CVEs confirmed to be exploited right now, with remediation deadlines for US federal agencies. In 2026, mature teams triage with all three: CVSS for how bad it could be, EPSS for how likely exploitation is, and KEV for what is already being used against real targets.

CVE vs CWE vs CVSS: Clearing Up the Acronyms

These three get conflated constantly, but they answer different questions. A CVE names a specific instance of a flaw in a specific product. A CWE (Common Weakness Enumeration) — another MITRE catalog — names the underlying type of mistake, such as CWE-79 for cross-site scripting or CWE-89 for SQL injection. And CVSS is the severity score attached to a CVE. One flaw (a CVE) belongs to a weakness class (a CWE) and carries a severity rating (a CVSS score).

Frequently Asked Questions

What does CVE stand for?

CVE stands for Common Vulnerabilities and Exposures. It is a program, run by the MITRE Corporation and funded by CISA, that assigns a unique public identifier to each known security vulnerability so the whole industry can reference it consistently.

Who assigns CVE identifiers?

CVE IDs are assigned by CVE Numbering Authorities (CNAs) — over 450 vendors, research organizations, and coordinators authorized by the CVE Program. Many companies, including Microsoft, Google, and Apple, are CNAs for their own products; MITRE acts as a CNA of last resort.

Is a high CVSS score the same as active exploitation?

No. A CVSS score measures how severe a flaw could be in theory. Whether it is actually being exploited is a separate question, answered by CISA’s KEV catalog and estimated by EPSS. A critical CVSS score with no known exploitation may be less urgent than a medium-severity flaw already in the KEV list.

What is the difference between a vulnerability and an exposure?

In CVE terms, a vulnerability is a flaw an attacker can exploit to compromise a system, while an exposure is a configuration or mistake that gives attackers access to information or capabilities they can use, without itself being a direct code flaw. Both can warrant a CVE record.

Further Reading

• CVE Program — Official overview (cve.org)
• NIST National Vulnerability Database
• FIRST — CVSS v4.0 specification
• CISA — Known Exploited Vulnerabilities Catalog
• FIRST — EPSS (Exploit Prediction Scoring System)

Related CyberSignal Guides

• What Is a Vulnerability in Cybersecurity?
• What Is an Exploit in Cybersecurity?
• What Is a Zero-Day Vulnerability?
• Vulnerability Management: The Complete Guide
• What Is Patch Management?