What is CVE (Common Vulnerabilities and Exposures)?

A CVE ID is a standardized identifier assigned to a publicly disclosed cybersecurity vulnerability. The accompanying CVE Record contains a description and at least one public reference, giving vendors, researchers, and defenders a consistent way to refer to the same security issue.

To remediate a vulnerability associated with a CVE, confirm which assets are affected, then prioritize it using CVSS severity, CISA KEV status, asset exposure, and business impact before testing and deploying the available fix. PDQ can help identify and prioritize exposed systems, then distribute patches or mitigations and support verification after deployment.

Here’s a CVE cheat sheet that might come in handy when you want to flex in front of the new CTO.

What is the CVE Program?

First launched by MITRE in 1999, the CVE Program identifies, defines, and catalogs publicly disclosed cybersecurity vulnerabilities. The program is sponsored by the Cybersecurity and Infrastructure Security Agency (CISA) and relies on a global network of CVE Numbering Authorities to assign CVE IDs and publish CVE Records.

How are CVEs identified and recorded?

The CVE identification and publication process includes five key steps:

1. Discovery and reporting: A researcher, vendor, customer, or other party discovers a potential vulnerability and reports it to an appropriate CVE Numbering Authority (CNA).

2. Eligibility and scope review: The CNA determines whether the issue meets CVE Program requirements and falls within its assignment scope.

3. CVE ID reservation: The CNA reserves a CVE ID, often before the vulnerability is publicly disclosed.

4. Disclosure coordination: The reporter, vendor, and CNA may coordinate fixes, advisories, affected-version details, and a disclosure date.

5. Record publication and updates: The CNA publishes the CVE Record with a description and at least one public reference. The record may be updated later as additional information becomes available.

CVE IDs

CVE IDs use the format CVE-YYYY-NNNN…, with a four-or-more-digit sequence number. The year generally indicates when the CVE ID was reserved or when the vulnerability was made public. It does not necessarily indicate when the vulnerability was discovered. (That’s at least worth a point or two at the next company trivia night. You’re welcome.)

What is the Common Vulnerability Scoring System (CVSS)?

CVSS scores range from 0.0 to 10.0 and describe the technical severity and characteristics of a vulnerability. However, teams should treat the Base Score as one input in the prioritization process, not as a complete measure of organizational risk or an automatic patch deadline.

CVSS v4.0 organizes its metrics into four groups: Base, Threat, Environmental, and Supplemental. The Base metrics describe the vulnerability’s intrinsic technical characteristics. The Threat group uses Exploit Maturity to reflect evidence of real-world exploitation. Environmental metrics let organizations adjust the assessment based on their security requirements and how the affected product is deployed. Supplemental metrics provide additional context but do not change the final numerical CVSS score.

Use CVSS alongside CISA KEV status, active exploitation, internet exposure, asset criticality, compensating controls, and potential business impact when setting remediation priority. You can review or calculate scores with the NVD CVSS calculators or the FIRST CVSS v4.0 calculator.

How do organizations prioritize CVE remediation?

Organizations should use CVSS as a severity baseline, not a complete risk score. Patch priority should also account for active exploitation, CISA KEV status, asset exposure, business criticality, available mitigations, and the potential impact of compromise.

The following targets are examples that organizations can adapt to their risk tolerance and operational capacity.

These targets are internal policy examples, not deadlines defined by CVSS. Move a vulnerability ahead of its default tier when it appears in the CISA Known Exploited Vulnerabilities Catalog, is being actively exploited, affects an internet-facing asset, or threatens a business-critical system.

For KEV entries, review the required action and due date supplied by CISA; those deadlines are mandatory for certain federal organizations and can serve as prioritization guidance for others. Organizations may also establish an emergency target of 24 to 72 hours for actively exploited vulnerabilities affecting exposed or critical systems.

What is the CVE remediation workflow?

A repeatable CVE workflow turns a published vulnerability into a verified fix. The exact tools vary, but the core process is to identify affected assets, determine risk, deploy the remediation, and confirm that it worked.

1. Monitor new CVEs and security advisories. Review CVE.org, NVD, vendor advisories, and the CISA KEV Catalog for vulnerabilities affecting products in your environment.

2. Identify affected systems. Use PDQ or another vulnerability management tool to locate endpoints running affected software or operating system versions.

3. Assign a remediation priority. Combine the CVSS score with KEV status, exploit activity, asset exposure, business criticality, and available mitigations.

4. Test and deploy the fix. Test the vendor patch or mitigation, then use PDQ or your existing patch management platform to deploy it to affected machines.

5. Verify and document remediation. Rescan affected systems, confirm that the vulnerable version or configuration is gone, document exceptions, and track remediation time against your internal SLA.

Track mean time to remediate separately for Critical, High, Medium, and Low findings. A single organization-wide MTTR can hide overdue critical vulnerabilities behind a large number of lower-priority fixes.

Useful CVE triage resources

• CISA Known Exploited Vulnerabilities Catalog: Identifies vulnerabilities with confirmed exploitation and provides required remediation actions and due dates.

• NVD CVSS calculators: Help teams inspect and adjust CVSS metrics and vectors.

• FIRST CVSS v4.0 calculator: Calculates and documents CVSS v4.0 vectors.

• PDQ: Adds endpoint vulnerability visibility, contextual risk prioritization, impacted-device data, and remediation guidance.

Useful vulnerability and exploit data sources

Different CVE databases provide different types of vulnerability information and analyses that can enhance your vulnerability management program — from severity ratings to details of known exploits. The top CVE databases include:

• CVE.org: Authoritative CVE IDs and CVE Records.

• National Vulnerability Database: CVE records supplemented with metrics and other enrichment when available.

• CISA Known Exploited Vulnerabilities Catalog: Vulnerabilities with confirmed exploitation.

• Vendor security advisories: Authoritative affected-version, mitigation, and patch information.

• GitHub Advisory Database: Open-source package and dependency vulnerabilities.

• VulDB: Commercial vulnerability intelligence and research.

• Exploit Database: Public exploit code and technical research; useful evidence, but not an authoritative CVE database.

Notable CVEs

There are vulnerabilities, and then there are vulnerabilities. Here are some that (despite their somewhat charming names) still plague our dreams, a cautionary reminder to never let down our guard.

How to choose a vulnerability scanner

In 2025 alone, we reached around 50,000 disclosed vulnerabilities. With this number growing each year, IT teams increasingly need to rely on security tools like vulnerability scanners to keep their environments secure (and the cold, hard fear of data breaches to a minimum).

Prioritize scanners that turn findings into actionable remediation work, not just longer vulnerability lists. Consider the following capabilities:

• Ease of use: Can IT staff configure scans, interpret findings, and assign remediation work without specialized security expertise?

• Scan coverage: Does the scanner cover the operating systems, applications, remote devices, cloud assets, and internet-facing systems in your environment?

• CVE data freshness: How quickly does it process new CVE records, vendor advisories, NVD updates, and CISA KEV additions?

• CVSS support: Does it support CVSS v3.1 and v4.0, display the complete vector, and incorporate Threat and Environmental context?

• Contextual prioritization: Does it consider active exploitation, asset exposure, business importance, and available mitigations instead of sorting only by Base Score?

• Patch management integration: Can it connect an identified vulnerability to an available patch, package, configuration change, or mitigation?

• Remediation verification: Does it rescan endpoints and confirm that the vulnerable software version or configuration has been removed?

• Reporting and SLA tracking: Can teams report on exceptions, overdue findings, remediation progress, and MTTR by severity?

• Scalability and support: Can the tool handle your current and expected asset count, and does the vendor provide dependable documentation and technical support?

Automate the tedious steps of vulnerability management with PDQ’s cloud-based endpoint management platform. Inventory managed devices, identify and prioritize vulnerabilities, and deploy one-click remediation when a suitable package or suggested update is available. After deployment, rescan affected devices to verify the fix. And should something go wrong with a patch—which would totally not be Microsoft’s fault, of course—use built-in remote desktop to troubleshoot the affected device. Try PDQ free for 14 days.