What is a CVE and how to interpret a CVSS score?

Published on 2026-10-20 by frfrand

Qué identifica una CVE, qué evalúa CVSS, por qué gravedad no significa riesgo inmediato y cómo priorizar actualizaciones.

A CVE is a public identifier assigned to a security vulnerability registered under certain rules. CVSS, on the other hand, is a system for describing and scoring vulnerability severity characteristics. They are not the same.

When you read «CVE-2026-XXXX, critical severity», there are still important questions before deciding what to do on your server.

The comparison with a catalog

Imagine a library. Each book has an identifier so everyone knows which one they are talking about. That is the role of a CVE: to make it easier for researchers, manufacturers, and administrators to refer to the same problem without confusing it with another.

A CVSS score is like a card that helps describe certain characteristics of the problem. But the card does not automatically tell you if that book is in your library or if someone is using it.

What information accompanies a CVE?

There may be a description of the flaw, references to vendor announcements, affected versions, and additional technical material. The record may also be updated when new details appear.

You should not assume that the short CVE text always includes all affected products. The manufacturer's official recommendations and the versions you have installed remain decisive.

What does CVSS measure?

CVSS includes metrics that seek to represent exploitation characteristics and impact under defined scenarios. Depending on the version of the standard, different components and terminology are used.

A high score indicates an important severity assessment, but it does not prove that your server is exposed at that moment. For example, a vulnerable component may be installed but not enabled, or only reachable from an internal network.

Neither does a low score guarantee that you can forget about the problem, especially if it affects a central piece of your business.

What does real risk mean?

Practical risk depends on several questions: do you use the affected version?, is the vulnerable function enabled?, who can reach the service?, is there active exploitation?, what data or processes could be affected?

If a tool is not installed, an alert about it may not have direct relevance for your team. If the same problem affects the public service that controls payments, the priority may be higher.

What is an actively exploited vulnerability?

It means that there are observations of exploitation under real conditions, not just a theoretical demonstration. Sources such as the CISA KEV catalog help identify vulnerabilities whose exploitation has been confirmed under their criteria.

That data can increase urgency, but you always have to verify what product and version your infrastructure uses.

A sensible prioritization process

1. Identify the software and versions actually installed.
2. Check the vendor advisory and the corresponding CVE record.
3. Verify exposure, required privileges, and possible impact.
4. Prioritize updates or mitigations based on risk and known exploitation.
5. Test the change and verify that the service continues to work.

It is not advisable to blindly update a critical database without a backup. Nor should an important patch be delayed indefinitely just because "nothing has happened yet."

Do all scanners have it right?

Scanners can produce false positives or interpret versions without considering patches that a distribution may have incorporated retroactively. Debian and Ubuntu, for example, can maintain a nominal version and apply security fixes.

Before considering a machine vulnerable, check the distribution's security information and the specific package.

What does it have to do with ArduMaker?

If you use VPS or managed applications from ArduMaker, maintaining a version inventory and reviewing security advisories helps you decide what to update first. The panel does not replace analyzing the impact of a CVE on each deployment.

In one sentence: CVE identifies a problem; CVSS helps describe its severity. Real risk requires adding exposure, context, and available measures.

Sources: CVE Program · CVSS de FIRST · Catálogo KEV de CISA.