CVE and CVSS

CVE stands for "Common Vulnerabilities and Exposures" and refers to a globally used catalogue that assigns every publicly disclosed software or hardware vulnerability a unique, permanent identifier in the format CVE-YYYY-NNNNN. The programme is coordinated by the MITRE Corporation and maintained by a network of CVE Numbering Authorities (CNAs), which include major vendors, CERTs and research organisations. Its purpose is purely referential: the identifier ensures that vendors, scanner providers, authorities and users are all talking about exactly the same flaw. Enriched descriptions and metadata are published, among others, in NIST's National Vulnerability Database (NVD) and, since 2025, in the European Vulnerability Database (EUVD) operated by ENISA on the basis of Article 12 of the NIS2 Directive.

CVSS – the "Common Vulnerability Scoring System" maintained by the Forum of Incident Response and Security Teams (FIRST) – supplies the matching assessment. It translates the technical characteristics of a vulnerability into a number between 0.0 and 10.0 and into the qualitative ratings "None", "Low", "Medium", "High" and "Critical" (critical from 9.0 upwards). The base score captures the intrinsic properties of the flaw: attack vector, complexity, privileges required, user interaction and the impact on confidentiality, integrity and availability. Version 3.1, still the most widely used in practice, adds temporal and environmental metrics on top of that base; version 4.0, published in 2023, restructures the model into base, threat, environmental and supplemental metric groups and makes the link to the specific deployment environment more explicit.

In practice, one distinction matters above all: a CVSS base score expresses severity, not risk. It knows nothing about the protection requirement of the affected system, its exposure, existing compensating controls or whether the flaw is actually being exploited in the wild. Meaningful prioritisation only emerges once the base score is combined with asset context and threat intelligence – through environmental metrics, exploitation likelihood scores such as EPSS, or catalogues of known exploited vulnerabilities. In normative terms, ISO/IEC 27001:2022 control 8.8 and the German BSI IT-Grundschutz module OPS.1.1.3 require exactly this kind of assessed, traceable handling of technical vulnerabilities, and Article 21 of the NIS2 Directive makes vulnerability handling and disclosure mandatory for essential and important entities. The Cyber Resilience Act (Regulation (EU) 2024/2847) builds on this by obliging manufacturers to report actively exploited vulnerabilities; under the text of the regulation these reporting duties apply from 11 September 2026, with the remaining requirements following in December 2027. As several EU digital files are currently being revised through simplification packages, deadlines should be verified against the current legal position before planning around them.