How do I know if a CVE affects my organisation?
Check four things in order: whether you run the affected product at all, whether your specific version falls in the affected range, whether the vulnerable component is reachable by an attacker, and whether any vendor mitigation already applies. A CVE only matters to you if all four line up — most published CVEs will fail at the first question.
The affected-version range is where most false alarms die. Advisories list precise version boundaries, and organisations frequently panic over a CVE affecting a major release they never deployed.
Reachability is the step teams skip most often. A vulnerability in a service that is not exposed, is behind authentication, or is disabled in your configuration carries very different urgency from the same flaw on an internet-facing box.
If all four conditions hold, escalate on exploitation evidence rather than severity alone: check CISA KEV, check whether exploit code is public, and check whether your vendor has published a workaround while you schedule the patch.
Related coverage
CVE & Vulnerabilitiesdispatches →Newly disclosed CVEs, actively exploited vulnerabilities, and critical patches you need to apply now.
More on practice