CVE - How Vulnerabilities Are Identified and Tracked

About 2 min read

CVE (Common Vulnerabilities and Exposures) is an international naming convention that assigns a unique identifier to publicly disclosed security vulnerabilities. Composed of a year and a sequential number, such as "CVE-2024-12345," it allows the same vulnerability to be referenced accurately across different vendors and tools. The MITRE Corporation began operating it in 1999, and as of 2025 more than 270,000 CVEs have been registered in total, with the number of new annual registrations also trending upward.

Identifying the Scope of Impact with an SBOM

When a critical CVE is disclosed, the first challenge is identifying where in your organization the affected product and version are in use. In cases with a broad impact, such as CVE-2024-3094, in which a backdoor was planted in xz Utils, the speed of this initial response can determine whether damage occurs. If software composition information is maintained day to day as an SBOM (software bill of materials), the affected locations can be found simply by matching against the CVE number; organizations without such an inventory spend much of their time on the investigation itself. When no fixed version exists yet, downgrading to an unaffected older version can also be a realistic countermeasure.

The CVE Lifecycle

History and How It Works

Before the CVE system existed, each vendor assigned a different name to the same vulnerability, causing confusion in information sharing. CVE numbers are issued by accredited bodies called CNAs (CVE Numbering Authorities). Major vendors such as Google, Microsoft, and Red Hat hold the authority to independently assign CVE numbers as CNAs for their own products. The severity of a vulnerability is evaluated with a CVSS (Common Vulnerability Scoring System) score from 0.0 to 10.0, and a score of 9.0 or higher is classified as "Critical."

Practical Application

In patch management work, response priorities are determined based on CVE numbers. It is important to make a comprehensive judgment that considers not only the CVSS score but also whether exploit code has actually been published and whether the vulnerability applies to your own environment. Regularly check CVE information on the NVD (National Vulnerability Database) and JVN (Japan Vulnerability Notes), and combine it with threat intelligence to achieve a rapid response. It is also important to protect access to vulnerability management tools with a strong random password and to prevent tampering with patch application records.