Common Vulnerabilities and Exposures

Common VulnerabilitiesVulnerabilityA technical or organizational weakness that can be exploited by a threat. and Exposures: Standardized identification of publicly known IT vulnerabilities. This topic concerns vulnerabilities and their exploitability. An effective process combines inventory, detectionDetectionThe capability to identify suspicious activity, attacks, or policy violations in time., risk-based prioritizationRisk-Based PrioritizationOrdering security work according to likelihood, impact, exposure, and business context., remediationRemediationThe correction or mitigation of a confirmed security weakness, defect, or misconfiguration., compensating controls, and verificationVerificationConfirmation that a requirement was met or a remediation achieved its intended result..

How it works and where it fits

Common Vulnerabilities and Exposures denotes a vulnerability or weakness class whose risk depends on technical cause, reachable attack surface, required conditions, and potential impact. The presence of a flaw is not the same as successful exploitation. Context such as exposed interfaces, available privileges, asset value, and compensating controls determines the actual urgency.

Practical security relevance

Proper treatment covers identification, reproducibility, risk assessment, remediation, and verification. A patch is only one possible measure; secure configuration, input validation, segmentation, or architectural change may be required depending on the cause. After remediation, targeted retesting should confirm that the original attack path is closed and that the change did not introduce harmful side effects.

Related concepts

• Common Vulnerability Scoring SystemCommon Vulnerability Scoring SystemStandard for assessing the technical severity of vulnerabilities.: Standard for assessing the technical severity of vulnerabilities.
• Vulnerability ManagementVulnerability ManagementContinuous process for the detection, prioritization, remediation, and tracking of vulnerabilities.: Continuous process for the detection, prioritization, remediation, and tracking of vulnerabilities.
• N-day VulnerabilityN-day VulnerabilityA previously disclosed vulnerability for which information or patches are available.: A previously disclosed vulnerability for which information or patches are available.
• Zero-Day VulnerabilityZero-Day VulnerabilityVulnerability for which no effective patch is available at the time of exploitation.: Vulnerability for which no effective patch is available at the time of exploitation.