CVE - How Vulnerabilities Are Identified and Tracked

About 2 min read

CVE (Common Vulnerabilities and Exposures) is an international naming convention that assigns a unique identifier to publicly disclosed security vulnerabilities. Composed of a year and a sequential number, such as "CVE-2024-12345," it allows the same vulnerability to be referenced accurately across different vendors and tools. The MITRE Corporation began operating it in 1999, and as of 2025 more than 270,000 CVEs have been registered in total, with the number of new annual registrations also trending upward.

Real-World Use Cases

"When CVE-2024-3094 (the backdoor in xz Utils) was disclosed, the vulnerability management team cross-referenced the SBOM and identified the scope of impact within two hours. Because it was rated Critical with a CVSS score of 10.0, we downgraded the packages on all servers the same day."

The CVE Lifecycle

History and How It Works

Before the CVE system existed, each vendor assigned a different name to the same vulnerability, causing confusion in information sharing. CVE numbers are issued by accredited bodies called CNAs (CVE Numbering Authorities). Major vendors such as Google, Microsoft, and Red Hat hold the authority to independently assign CVE numbers as CNAs for their own products. The severity of a vulnerability is evaluated with a CVSS (Common Vulnerability Scoring System) score from 0.0 to 10.0, and a score of 9.0 or higher is classified as "Critical."introductory books on vulnerability management (Amazon) offer a systematic way to learn.

Practical Application

In patch management work, response priorities are determined based on CVE numbers. It is important to make a comprehensive judgment that considers not only the CVSS score but also whether exploit code has actually been published and whether the vulnerability applies to your own environment. Regularly check CVE information on the NVD (National Vulnerability Database) and JVN (Japan Vulnerability Notes), and combine it with threat intelligence to achieve a rapid response. It is also important to protect access to vulnerability management tools with a strong random password and to prevent tampering with patch application records.books on security information management (Amazon) are also a helpful reference.