How CVE works
When a vulnerability is discovered, a CVE Numbering Authority assigns an ID in the format CVE-year-number, along with a brief description and references. The program is run by MITRE with funding from the United States government, and many vendors act as numbering authorities for their own products.
The ID lets scanners, advisories, and patch notes refer to the same flaw unambiguously. Databases such as the National Vulnerability Database add severity scores and affected product data. Not every CVE is exploitable in every environment, so context is needed to prioritize.
Why it matters for Canadian organizations
CVE identifiers are how security alerts from the Canadian Centre for Cyber Security, vendors, and scanners are matched against your assets. Without them, tracking whether a particular flaw affects your software would be slow and error-prone.
When a critical CVE is announced for a widely used product, attackers often begin scanning for it within hours or days. Organizations that can quickly map CVEs to their inventory, and patch or mitigate accordingly, reduce exposure. Frameworks like ISO 27001 and OSFI B-13 expect timely vulnerability remediation.
How to implement it
Maintain an accurate asset and software inventory so a new CVE can be matched to what you actually run. Subscribe to advisories from your vendors and national authorities, and use vulnerability scanning to find affected systems.
Prioritize using severity, whether the flaw is being exploited in the wild, and how exposed the system is. Track remediation times against internal targets, apply compensating controls where patches are delayed, and verify fixes with a rescan afterward. Retest afterward to confirm that the vulnerability is actually closed.
Frequently asked questions
What does a CVE number mean?
A CVE number such as CVE-2024-1234 is a unique label for one publicly known vulnerability. The year usually reflects when the ID was assigned or published, and the number is a sequence, not a measure of severity. Tracking CVE numbers lets teams search advisories and scanners consistently.
What is the difference between CVE and CVSS?
CVE identifies and describes a specific vulnerability. CVSS scores how severe it is on a scale from 0 to 10. Security teams use both, along with exploit information, to decide what to fix first. Use both together, plus exploit evidence, when deciding what to patch first.
Does every vulnerability have a CVE?
No. Many flaws in custom or internal software never receive one, and some vulnerabilities are undisclosed. CVE covers publicly disclosed issues in products that participating authorities have assessed and registered. Vendors and researchers can request an ID through participating authorities, so entries are not limited to well-known products or software brands.
Related service: Vulnerability management