What Is a CVE (Common Vulnerabilities and Exposures)?

Definition

A CVE (Common Vulnerabilities and Exposures) is a unique public ID, such as CVE-2023-34362, assigned to one specific, publicly disclosed security flaw in a product. The ID lets vendors, security tools, advisories, and IT teams refer to exactly the same problem, so everyone knows which flaw a patch fixes and which systems are affected.

How It Works

The CVE Program's stated mission is to "identify, define, and catalog publicly disclosed cybersecurity vulnerabilities," with one CVE Record for each vulnerability. Records are assigned and published by CVE Numbering Authorities (CNAs): software vendors, researchers, and coordination centers authorized to number flaws in their scope, with CISA and MITRE serving as the program's two Top-Level Roots. The program's metrics page lists 557 CNAs from 43 countries, and reports 48,244 CVE records published in 2025, up from 40,077 in 2024.

A CVE record contains:

The ID: "CVE," the year, and a sequence number.
A description of the flaw and the affected product versions.
References to vendor advisories and patches.

A CVE record is not a severity rating. Scores come from elsewhere: the vendor or the US National Vulnerability Database (NVD) usually adds a CVSS score, and CISA flags the ones being actively exploited in its Known Exploited Vulnerabilities (KEV) catalog. Most security tools, from vulnerability scanners to patch dashboards, match findings by CVE ID.

The ID only helps if you can map it to your own systems. That requires knowing which products and versions you run.

Real-World Example

On May 27, 2023, according to a joint FBI and CISA advisory, the CL0P ransomware gang began exploiting a previously unknown SQL injection flaw in MOVEit Transfer, a file transfer product from Progress Software. The flaw was published as CVE-2023-34362 on June 2, 2023, and NVD records show CISA added it to the KEV catalog that same day. From then on, every vendor bulletin, scanner check, and advisory, including the FBI and CISA advisory issued June 7, used that single ID, which let MOVEit customers quickly check whether their version was affected and whether they had applied the fix.

Why It Matters for a Small Business

With tens of thousands of new CVE records a year, no business can read them all. The practical value of the CVE system for a small business is matching: when a vendor, your IT provider, or a news story names a CVE, you can answer "do we run that, and are we patched?" quickly. That depends on an up-to-date list of your software and versions, including website plugins and the firmware on firewalls. It also helps you hold vendors to account, because a CVE ID turns a vague "security fix" into a specific, checkable claim.

How to Spot It / How DTS Handles It

You will see CVE IDs in vendor security bulletins, scanner reports, and CISA alerts. A useful test: pick a recent CVE in software you use and see how long it takes to confirm whether you are affected.

DTS can help with tracking CVEs against your asset inventory, flagging anything in the KEV catalog, and reporting which systems are patched. See our managed IT service.

Related Terms

CVSS: the severity score attached to many CVEs.
CWE: the type of weakness behind a CVE.
CISA KEV catalog: CVEs known to be exploited.
EPSS: a forecast of which CVEs will be exploited.
Patch management: fixing what a CVE describes.
Vulnerability disclosure: how flaws get reported before a CVE is published.
Supply chain attack: how one CVE in a vendor product reaches many victims.

Sources

CVE Program, Metrics: https://www.cve.org/About/Metrics
CVE Program, Overview: https://www.cve.org/About/Overview
FBI and CISA, #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability, AA23-158A (June 7, 2023): https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a
NIST National Vulnerability Database, CVE-2023-34362 Detail: https://nvd.nist.gov/vuln/detail/CVE-2023-34362

Last updated October 14, 2026.