What a CVE is — and what it isn't
A CVE is an identifier: a catalog number for a publicly known vulnerability in a specific piece of software. CVE-2024-XXXXX tells you a flaw exists and where. Attached to it you'll usually find a CVSS score from 0 to 10, which attempts to summarize severity: how the flaw is reached (network vs. local), how hard it is to trigger, whether it needs privileges or user interaction, and what an attacker gets.
What a CVE is not: a statement about your risk. Tens of thousands of CVEs are published every year. Only a small fraction are ever exploited in the wild. A 9.8 in software you don't expose may matter less than a 7.5 on your internet-facing VPN appliance. Reading CVEs well means adding the context the score deliberately leaves out.
The three questions that actually rank a CVE
Is it being exploited? Known exploitation beats theoretical severity every time. CISA's Known Exploited Vulnerabilities (KEV) catalog lists CVEs with confirmed in-the-wild use — anything on it that you run is automatically this week's work. EPSS, a probability score for exploitation in the next 30 days, is a useful second signal.
Can an attacker reach it? A network-exploitable CVE on an internet-facing system is a different animal from the same CVE on a server buried behind three network layers. This is why vulnerability data divorced from asset context misleads: exploitability is a property of the flaw and the placement.
What happens if they do? Unauthenticated remote code execution on the box that holds customer data outranks a local privilege escalation on a kiosk. Business impact — what the affected asset stores, touches, and connects to — is the tiebreaker CVSS cannot see.
A five-minute triage that holds up
For each new CVE affecting software you run: check KEV (on the list → patch now); check exposure (internet-reachable and network-exploitable → this week); check the asset's importance (crown-jewel data or admin tooling → this week); otherwise, schedule it into normal patch cadence and move on without guilt. The discipline isn't patching everything fast — nobody does — it's being able to say why each item is in the pile it's in.
The prerequisite for all of this is knowing what you run, which is where most SMBs quietly fail: you cannot triage a CVE against an inventory you don't have. Cybermatic builds that inventory from its own device agent — which detects CVEs and end-of-life software natively — and from the scanners you already run, then groups everything by CVE with the affected devices listed, so the three questions above are answerable in one screen.
Related on the platform