§Answers
Security questions, answered.
Short, direct answers to the questions that come up constantly — what a CVE actually is, what a CVSS score does and does not tell you, and how to decide what to patch first. No preamble.
Vulnerabilities
What is a CVE?
A CVE is a public identifier for one specific security vulnerability, written as CVE-YEAR-NUMBER, for example CVE-2024-3094. It is assigned by a CVE Numbering Authority so that vendors, researchers and defenders can all refer to the same flaw unambiguously. A CVE identifier records that a vulnerability exists; it does not by itself say how severe or exploitable it is.
What is a zero-day vulnerability?
A zero-day is a vulnerability that is being exploited, or is publicly known, before the vendor has a patch available — leaving defenders zero days to have fixed it. The term is used loosely for three related things: an unknown flaw, an unpatched flaw, and an attack using one. The distinction matters because only the third means someone is being attacked.
What is the difference between a vulnerability, an exploit, and a threat?
A vulnerability is a weakness in a system. An exploit is the technique or code that takes advantage of that weakness. A threat is the actor or event with the intent and capability to use it against you. Risk is what emerges when all three meet something valuable that you own and have not adequately protected.
Prioritisation
What does a CVSS score actually mean?
CVSS is a 0–10 severity score describing how bad a vulnerability would be if exploited. In CVSS v3.1 the bands are Low 0.1–3.9, Medium 4.0–6.9, High 7.0–8.9 and Critical 9.0–10.0. The score most people quote is the Base score, which measures intrinsic severity only — it says nothing about whether anyone is actually exploiting the flaw.
What is the CISA KEV catalog?
The CISA Known Exploited Vulnerabilities catalog is a public list of CVEs with confirmed evidence of exploitation in the wild. It was established by US Binding Operational Directive 22-01 and sets remediation deadlines that federal civilian agencies must meet. Because entries require observed exploitation rather than theoretical severity, KEV is one of the strongest available signals that a vulnerability needs attention now.
What is EPSS and how is it different from CVSS?
EPSS, the Exploit Prediction Scoring System, estimates the probability that a vulnerability will be exploited in the wild in the next 30 days, expressed as a value between 0 and 1. CVSS measures how damaging exploitation would be; EPSS estimates how likely it is to happen. They answer different questions and are strongest when used together.
Attacks
What is double extortion ransomware?
Double extortion ransomware both encrypts your data and steals a copy of it before encrypting. The attacker then demands payment twice over: once to restore your systems, and again to stop publication of the stolen data. It exists because reliable backups defeat plain encryption, so attackers added a second form of leverage that backups cannot undo.
What is a software supply chain attack?
A software supply chain attack compromises something you trust and install, rather than attacking you directly. Typical routes are a poisoned package in a public registry, a compromised vendor update, or stolen build infrastructure. It is effective because the malicious code arrives through a legitimate, signed, expected channel that your defences are configured to allow.
Practice
How do I know if a CVE affects my organisation?
Check four things in order: whether you run the affected product at all, whether your specific version falls in the affected range, whether the vulnerable component is reachable by an attacker, and whether any vendor mitigation already applies. A CVE only matters to you if all four line up — most published CVEs will fail at the first question.
How quickly should I patch a critical vulnerability?
Patch anything with confirmed in-the-wild exploitation on internet-facing systems within days, not weeks — CISA KEV deadlines for US federal agencies are typically two to three weeks and are treated as a ceiling, not a target. Everything else belongs on a risk-ranked cycle driven by exposure and exploitation probability rather than severity score alone.