CVE, short for Common Vulnerabilities and Exposures, is the global program and catalog that assigns a unique, standardized identifier to each publicly disclosed cybersecurity vulnerability, such as CVE-2021-44228. In the vulnerabilities field, a CVE ID works as a common name that lets vendors, scanners, security advisories and incident responders refer to exactly the same flaw without ambiguity.
The program was launched by MITRE in 1999 and is sponsored by the US Cybersecurity and Infrastructure Security Agency (CISA). A CVE record is deliberately minimal: it identifies and briefly describes a vulnerability, while severity scoring, weakness classification and exploitation data come from related systems such as CVSS, CWE and the CISA Known Exploited Vulnerabilities catalog.
Anatomy of a CVE identifier and record
Every CVE identifier follows the syntax CVE-YYYY-NNNN, where the middle part is a year and the last part is a sequence number of four or more digits. The variable-length sequence was introduced in 2014 because the original four-digit limit would have capped the program at 9,999 identifiers per year.
| Part | Example | Meaning |
|---|---|---|
| Prefix | CVE | Marks the string as a CVE identifier |
| Year | 2021 | Year the ID was reserved or published, not necessarily the year the flaw was found |
| Sequence number | 44228 | Arbitrary number of four or more digits; it carries no meaning about severity or order of discovery |
Behind the identifier is a CVE record in a JSON-based format. Its core fields are the affected product and versions, a short description of the flaw and at least one public reference such as a vendor advisory. A record can be in one of three states: reserved (ID allocated but details not public), published or rejected (for example because it was a duplicate or not a vulnerability).
A frequent misreading concerns the year. A flaw disclosed in January may carry the previous year’s ID because the CNA reserved the number in advance, so the year is not a reliable indicator of when the vulnerability became public.
Who assigns CVE IDs
CVE IDs are assigned by a federated network of CVE Numbering Authorities (CNAs), which today counts several hundred organizations. Most CNAs are software and hardware vendors that number flaws in their own products, while others are security research firms, national CERTs and open-source foundations.
| Role | Typical organizations | Function |
|---|---|---|
| CVE Board | Representatives of industry, government and research | Governs the program, its rules and strategy |
| Top-level roots | MITRE and CISA | Oversee the hierarchy and recruit and govern roots and CNAs |
| Roots | Large CNAs and national CERTs | Manage a group of CNAs in a region or sector |
| CNAs | Vendors, open-source projects, researchers | Assign IDs and publish records within an agreed scope |
| CNA of last resort | MITRE, and CISA for industrial control systems | Assigns IDs when no other CNA covers the product |
| Authorized data publishers | Organizations such as CISA | Add enrichment data such as scores and weakness types to existing records |
A vulnerability receives a separate ID when it can be fixed independently of other flaws. CNA counting rules therefore decide whether two related bugs get one ID or two, which directly affects patch tracking and vulnerability statistics.
CVE compared with related vulnerability standards
CVE is often confused with the systems that build on it. The key distinction is that CVE identifies a specific flaw, while the other standards describe its severity, type, affected products or likelihood of exploitation.
| Standard | Question it answers | Example value |
|---|---|---|
| CVE | Which specific vulnerability is this? | CVE-2021-44228 |
| CVSS | How severe is it in technical terms? | Base score 10.0, critical |
| CWE | What kind of weakness caused it? | CWE-502, deserialization of untrusted data |
| CPE | Which exact products and versions are affected? | A structured name for a vendor, product and version |
| KEV catalog | Is it known to be exploited in the wild? | Listed with a remediation due date for US federal agencies |
| EPSS | How likely is exploitation in the next 30 days? | A probability between 0 and 1 |
The National Vulnerability Database (NVD), operated by NIST, historically added CVSS scores, CWE mappings and CPE data to CVE records. Since 2024, a large NVD analysis backlog has left many new CVEs without enrichment for weeks or months, so mature teams also rely on vendor scores, CNA-provided data and exploitation signals.
A zero-day is a different concept: it describes a vulnerability exploited before a fix exists, and it may or may not already have a CVE ID at the time of the attack.
The lifecycle of a CVE record
Most CVEs follow a coordinated vulnerability disclosure process in which the finder, the vendor and a CNA agree on timing so that a fix is available when details become public. The table shows the typical stages.
| Stage | What happens | Main actor |
|---|---|---|
| Discovery and report | A researcher or vendor finds the flaw and reports it privately | Finder |
| Reservation | A CNA allocates an ID in the reserved state | CNA |
| Fix development | The vendor develops and tests a patch or mitigation | Vendor |
| Publication | The record is published together with the advisory | CNA |
| Enrichment | Scores, weakness types and product data are added | NVD and data publishers |
| Remediation | Organizations match the ID to their inventory and patch | Users and operators |
Embargo periods vary widely. Many disclosure policies use a 90-day deadline as a default, while actively exploited flaws are often published within days. Once published, the CVE ID becomes the join key that connects scanner findings, patch notes, threat intelligence and ticketing systems.
Limitations and common misconceptions
The program has grown quickly, with roughly 40,000 CVEs published in 2024 alone, and that volume exposes its limits. Not every vulnerability gets an ID: flaws in custom software, many cloud services and products outside any CNA scope often remain without a CVE, so an empty scanner report does not mean an absence of risk.
- A CVE ID is not a severity rating. Many published CVEs are low impact or hard to exploit, and prioritizing by count alone wastes effort.
- Record quality varies by CNA. Descriptions can be vague and affected version ranges incomplete, which causes false positives and false negatives in scanners.
- Some CNAs assign IDs very liberally. The Linux kernel project became a CNA in 2024 and now assigns IDs to a large number of fixed bugs, many of which have no proven security impact.
- Program continuity depends on public funding. A near lapse of the MITRE contract in 2025 showed that the global vulnerability naming system relies on a single government sponsor.
The practical lesson is to treat CVE as the naming layer of vulnerability management and to combine it with asset inventory, exploitation data and business context before deciding what to patch first.
The idea in brief
A CVE is like a case number for a security flaw. When someone finds a weakness in a program, it receives an official number such as CVE-2021-44228, and everybody uses that number when talking about it.
This shared name lets a software maker, a security company and an IT department know they mean the same problem. The number itself does not say how dangerous the flaw is; other systems add that information.
A practical scenario
In December 2021, a security team at a mid-sized logistics company learns about CVE-2021-44228, the remote code execution flaw in the Apache Log4j 2 library known as Log4Shell, rated 10.0 under CVSS. Because their vulnerability scanner, software bill of materials and vendor advisories all reference the same ID, the team can search every data source with one identifier.
Within hours, they find the vulnerable library in 23 internal applications and in two vendor appliances. Over the following weeks, the Log4j project publishes further fixes and new IDs, including CVE-2021-45046 and CVE-2021-45105, and the team tracks each one separately until all systems run version 2.17.1 or later. The common identifier turns a chaotic news event into a measurable remediation project with a clear finish line.