Who discovers a CVE and what happens from the report to the patch?
Published on 2026-10-27 by frfrand
Practical guide to vulnerability discovery: researchers, CNA, coordinated disclosure, CVE, patches, and false alarms.
Where do the CVE numbers that appear in the news come from?
A CVE does not arise because someone writes "I found a bug" on a social network. CVE is a program that assigns public identifiers to vulnerabilities so that everyone can refer to the same flaw. The record is published through authorized organizations, known as CVE Numbering Authorities (CNA). A finding may first go through a private coordination, testing, and remediation process.
Who discovers vulnerabilities?
They can be found by independent researchers, manufacturer security teams, students, authorized pentesting professionals, bug bounty programs, or teams that maintain open source projects. Some findings appear when reviewing code and comparing versions, others when studying formats, protocols, or unexpected behaviors of an app. Finding a bug does not guarantee that it is an exploitable vulnerability: impact and scope must first be analyzed.
How is a flaw discovered, in general terms?
A difference is identified between what the software should allow and what it effectively allows. For example: a validation function that does not block an operation, a service that consumes resources without limits, or a library that mishandles a format. In authorized environments, conditions are reproduced, the test case is reduced, and the affected version is recorded. It is not appropriate to test these hypotheses on third-party sites without permission.
What does the researcher do next?
Usually, they look for the provider's official security channel: private address, form, or vulnerability report. They provide a reproducible description, versions, expected impact, and sufficient evidence for the maintenance team to validate the issue. It is important to avoid exposing credentials, real user data, or details that facilitate abuse before a fix exists.
What is coordinated disclosure?
The researcher and the manufacturer attempt to agree on a reasonable window to analyze the problem, prepare a patch, and warn those who maintain servers. Coordination is not always perfect: there are cases with delays, disagreements, or prior leaks. What is important for those who manage systems is that, when the notice appears, they contrast the details with the provider and not with alarmist headlines.
Who assigns the CVE number?
An authorized CNA can reserve and publish an identifier following the program rules. The year and the number do not express severity. The CVSS score is a different analysis; it also does not confirm by itself that a vulnerability is being exploited. There are catalogs such as CISA KEV that collect flaws with known exploitation according to their criteria.
What does 'exploiting' a CVE mean?
It means getting the software's behavior to bypass a security restriction. It can mean reading data without permission, interrupting a service, performing an unauthorized operation, or executing instructions. Not all CVEs are ready-to-use exploits, nor do all exploits work on any version or configuration. Additionally, a proof of concept in a lab does not equate to observing active attacks.
How is a vulnerability fixed?
The vendor investigates the root cause, creates a patch, and publishes a version or configuration that eliminates the problem. A patch can be in the runtime, a system package, a plugin, a Docker image, or the application's own logic. Whoever manages the infrastructure must update the component actually being executed, not just the project repository, and confirm after testing that the problem has been resolved.
How do I prioritize alerts on my server?
Check: installed component, exact version, vulnerable configuration, access from the Internet, authentication requirement, affected data, evidence of exploitation, and patch availability. Do not rely solely on CVSS. A medium-severity issue on your most critical endpoint may deserve attention before a high-severity one on a disabled function.
Frequently asked questions
Does a scanner mentioning a CVE confirm a hack? No. It may indicate exposure, suspicion, or even a false positive.
Who pays whoever discovers the flaw? It depends: some programs have rewards and others are based on voluntary disclosure.
Can I search for vulnerabilities on any website? Active testing requires authorization from its owner and an agreed scope.
How do I know if a fix is official? Check the vendor's advisory, its security repository, and the CVE record.
Sources: CVE Program · CISA KEV Catalog · Python Security Advisories · Node.js Security Policy.
Where is the information updated and how to request guidance?
At ArduMaker — CVE and support we maintain information to review incidents and channel inquiries, especially in WordPress and the technologies that run it. To evaluate a specific case, provide technology, version, operating system, deployment mode, and relevant error messages without publishing credentials. An announced CVE does not mean that all systems are compromised.
Editorial review: October 27, 2026. Recommendations may change with new vendor publications.
Practical example: the full journey of a security report
Fictional scenario: a researcher, working in an authorized environment, detects that a user with a read role can access a modification operation. They do not test anything against other clients: they document the issue in a test environment.
- Discover: reproduce the difference between expected permissions and the result obtained, record the version and the minimum steps.
- Report: use the developer's private security channel, without publishing real data or sensitive information.
- Validate: the maintenance team confirms the behavior and determines scope and impact.
- Coordinate: prepare patch, regression tests, announcement and, when appropriate, a CVE identifier through the authorized CNA.
- Fix: publish an update and communicate which versions are affected.
- Verify: administrators update in staging, deploy and check that the read role can no longer modify anything.
Before the patch: a control was applied only in the interface. After: authorization is also checked on the server and in the actual operation, with an automated test.
Frequently asked question: what evidence is useful? Versions, relevant configuration, observed impact, safe reproducible steps and an explanation of the expected result; never third-party passwords.