CVE, CVSS and CWE: what the security identifiers mean
Understand vulnerability identifiers, severity scoring and weakness categories, and how to use them together without confusing severity with risk.
Security advisories often contain a CVE identifier, a CVSS score and a CWE identifier. These labels answer different questions: which publicly known vulnerability is being discussed, how its technical severity is described, and what kind of underlying weakness may be involved. They complement each other and are not interchangeable.
## CVE: identify a vulnerability
Common Vulnerabilities and Exposures (CVE) provides common identifiers for publicly known cybersecurity vulnerabilities. A CVE identifier helps people connect advisories and other records about the same vulnerability. The identifier is not a patch, a proof of exploitation or a severity score. Its record and references can change as more information becomes available. See the [NIST CVE glossary entry](https://csrc.nist.gov/glossary/term/common_vulnerabilities_and_exposures).
A vulnerability is a weakness that can be exploited to compromise a system's security. A record may name affected products or versions, but the identifier alone does not establish whether a particular installation is vulnerable. Check the current vendor advisory, actual deployed version and configuration before deciding what applies.
## CVSS: describe severity, not complete risk
The Common Vulnerability Scoring System (CVSS) describes technical characteristics of a vulnerability and produces a numerical severity score. A vector records the selected metric values and the version used. CVSS scores do not prove active exploitation, and a high base score alone does not measure risk to a particular organization.
CVSS v4.0 includes Base, Threat, Environmental and Supplemental metric groups. The Base metrics describe intrinsic characteristics; Threat and Environmental metrics can add information about exploit maturity and the particular environment. Supplemental metrics provide context without changing the resulting score. Use the reported version, vector and metric groups when comparing assessments; v3.1 and v4.0 are not interchangeable scales. [FIRST's CVSS v4.0 specification](https://www.first.org/cvss/v4.0/specification-document) explains these distinctions.
## CWE: classify a weakness
Common Weakness Enumeration (CWE) is a community-developed list of software and hardware weaknesses. A weakness is a condition that can contribute to vulnerabilities under certain circumstances. A CWE category describes the type of weakness; it is not itself a CVE record for a specific product. Vulnerability records may include a CWE mapping, but a missing or broad mapping does not prove that no weakness exists. See [MITRE's explanation of CWE](https://cwe.mitre.org/about/index.html).
## A practical triage example
In an illustrative case, a vendor advisory identifies a vulnerability with a CVE ID, supplies affected versions and a fix, and includes a CVSS assessment. A linked weakness category may explain a relevant failure pattern. A response team checks whether the affected component is deployed, whether it is reachable, whether a fix or mitigation applies, and whether trusted sources report exploitation. The team records uncertainties rather than treating a numerical score as proof of its own exposure.
Vulnerability management is the ongoing process of identifying, assessing, prioritizing and addressing vulnerabilities and tracking the result. Use the vendor advisory and relevant threat information alongside asset inventory, exposure and operational impact. For related response planning, see [Mithril's incident response guide](https://blog.mithril.fund/cyber-incident-response-by-country?lang=en). Sources reviewed on 2026-10-29. This guide does not establish the status or risk of any particular system.