What Is a CVE? How to Read CVE, CVSS, EPSS and KEV in a Security Alert

What is a CVE? It is a public ID number for one known security flaw in one piece of software, such as CVE-2026-85097. The number lets a vendor, a scanner, a host and your developer all talk about the same bug without confusion. It says nothing on its own about how bad the bug is.

You see these IDs in our posts, in plugin update notes and in alerts from Wordfence or Patchstack. They usually arrive with more numbers attached: a CVSS score, an EPSS score, or a note that the flaw is in CISA’s KEV catalog. This guide answers what is a CVE, who assigns one, what each number measures and leaves out, and how to use them together to decide what to patch first. It ends with a worked example from one of our own posts.

The short version: a CVE ID is just a name. CVSS estimates how bad a flaw could be. EPSS estimates how likely it is to be exploited soon. KEV tells you it has been exploited. None of them knows whether you run the affected software, which version you have, or whether the vulnerable feature is reachable on your site. That part is your job, and it matters more than any score.

What is a CVE, in plain terms

CVE stands for Common Vulnerabilities and Exposures. It is a program that gives publicly disclosed security flaws a unique ID and a short public record.

Each ID points to a CVE Record. Under the program’s CNA rules, a record has to name the affected product, give affected or fixed versions, describe the flaw in plain prose, and include at least one public reference. The reference is usually a vendor advisory or a researcher’s write-up.

Three things a CVE is not:

• Not a severity rating. Scores come from CVSS and other systems, often added by someone else.
• Not proof of attacks. A record does not say whether anyone is exploiting the flaw.
• Not a fix. The fix lives in the vendor’s release. The record points you to it.

Not every flaw gets a CVE either. Some are fixed in a changelog with no ID at all. Our Bricksforge post covers one: a second upload issue fixed in version 4.0.1 with no CVE named.

So what is a CVE good for? Coordination. It gives everyone one name for one problem, so a scanner, an advisory and a changelog can point to the same bug.

Who assigns CVE IDs

The CVE Program launched in 1999. MITRE says the program is sponsored by CISA, the US Cybersecurity and Infrastructure Security Agency, and managed through an institute that MITRE operates. In its 25th anniversary release in October 2024, MITRE counted over 400 CVE Numbering Authorities from 40 countries and over 240,000 records.

A CVE Numbering Authority, or CNA, is an organization authorized to assign CVE IDs for flaws in a defined scope. In practice, the CNA is usually the first place a CVE comes from. Several matter to our readers:

Many software vendors are their own CNA. Palo Alto Networks assigned the GlobalProtect flaw we covered this week. VulnCheck, a security research company, assigned the Ghostscript flaw. So did Wordfence for Bricksforge, according to the NVD record.

Two points follow. The CNA usually writes the first description and often the first CVSS score. Other groups may score the same CVE differently. Patchstack did not assign the Bricksforge ID, and its score for that flaw differs from Wordfence’s.

How to read a CVE ID

A CVE ID has three parts: the prefix CVE, a year, and a sequence number.

• CVE-2026-0257: the GlobalProtect flaw, a four-digit sequence number.
• CVE-2026-85097: the Bricksforge flaw, five digits.
• CVE-2026-108097: the Drupal core flaw from October 14, six digits.

The sequence number used to be fixed at four digits. That allowed only 9,999 IDs a year. Under a syntax change that took effect on January 1, 2014, the sequence can have four or more digits. Six-digit IDs already appear in 2026 advisories, such as the Drupal one above.

The digits after the year are arbitrary. A higher number does not mean a worse bug or a bigger vendor.

Two record states are worth knowing:

• Reserved. The ID exists, but the details are not public yet. You may see a reserved ID in a vendor advisory before the full record appears.
• Rejected. The ID and its record should no longer be used.

If a scanner flags an ID you cannot find, check for one of those two states before you assume the tool is wrong.

CVSS: the severity score

CVSS, the Common Vulnerability Scoring System, is maintained by FIRST, the Forum of Incident Response and Security Teams. It turns a set of judgments about a flaw into a score from 0.0 to 10.0.

The score maps to a rating. Both current versions use the same scale:

The base score asks questions like these. Can the attack come over the network? Does the attacker need an account? Does a user have to click something? What could the attacker read, change or break? Those last three map to confidentiality, integrity and availability, the same ideas in our CIA triad primer.

Every score comes with a vector string. It is the short code that records each answer. For example, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reads as: network attack, low complexity, no privileges, no user action, high impact on all three. That vector produces 9.8. Learning to read the vector tells you more than the number does.

CVSS v3.1 and v4.0: what changed

You will see both versions in advisories. FIRST released CVSS v4.0 in November 2023, but many CNAs and databases still publish v3.1 scores, and some publish both.

The main differences for a reader:

• A new question about attack requirements. Version 4.0 adds Attack Requirements (AT): does the attack only work under certain conditions, such as a specific setting?
• Two kinds of impact. Version 4.0 drops v3.1’s Scope metric. It scores impact on the vulnerable system and on subsequent systems separately.
• Threat replaces Temporal. The optional group that reflects exploitation is now called Threat. Its key metric is Exploit Maturity: Attacked, Proof-of-Concept or Unreported.
• Labels for what was scored. Version 4.0 asks publishers to say which groups went into a number: CVSS-B for base only, CVSS-BT for base plus threat, CVSS-BE and CVSS-BTE for the rest.

That last change helps. A CVSS-BT score already includes the scorer’s view of exploitation. Palo Alto Networks’ 7.8 for GlobalProtect is a CVSS-BT score with Exploit Maturity set to Attacked.

A v3.1 score and a v4.0 score for the same flaw are not meant to match. Compare like with like, and read the vector.

What a CVSS base score does not tell you

The base score describes the flaw itself. The CVSS v4.0 specification says base metrics are constant over time and across environments, and that the score assumes the reasonable worst case. It tells consumers to add threat and environmental information for a fuller input to risk assessment.

In practice, a base score leaves out four things:

1. Whether you run the software. A 10.0 in a plugin you do not use is a 0 for you.
2. Whether anyone is exploiting it. A base score is the same on the day of disclosure and the day mass attacks start.
3. Your setup. A flaw that needs a feature you have turned off may not be reachable on your site.
4. Who scored it. Different scorers reach different numbers for the same CVE.

The Ghostscript flaw from our PDF upload post shows the fourth point. VulnCheck, the CNA, scored CVE-2026-39919 at 9.8 in v3.1 with a network attack vector. Red Hat scored it 7.8, Moderate, with a local vector, because someone has to process a crafted PDF. Both are defensible. For a CMS that turns public PDF uploads into thumbnails, the higher reading is closer to your reality.

When two scores disagree, do not average them. Ask which assumptions match how your site uses the software.

EPSS: the odds of exploitation

EPSS, the Exploit Prediction Scoring System, is also run by FIRST. FIRST describes it as a machine-learning model that estimates the probability a published CVE will be exploited in the wild in the next 30 days. Scores are published daily for every scored CVE, and the data is free.

Each CVE gets two numbers:

• Probability. A value from 0 to 1. A score of 0.97 means the model puts the chance of exploitation activity in the next 30 days at about 97%.
• Percentile. How that probability ranks against every other scored CVE. A percentile of 0.99 means it scores higher than 99% of them.

EPSS answers a different question from CVSS. CVSS asks how bad a flaw could be. EPSS asks how likely it is to be used. A flaw can be severe and unlikely, or moderate and very likely. FIRST’s own user guide says EPSS should never be treated as a risk score on its own, since it covers only the threat part of risk.

Two limits matter for website teams. EPSS does not know your environment. And it is built from the exploitation data its partners can see. Our reading is that attacks on niche WordPress plugins may not show up there quickly. The worked example below suggests that.

Use EPSS to sort a long list. Do not use a low EPSS score to dismiss a flaw that a trusted source says is under attack.

The CISA KEV catalog: what "known exploited" means

The Known Exploited Vulnerabilities catalog, or KEV, is CISA’s list of flaws with confirmed attacks. CISA’s KEV page sets three conditions for adding an entry:

1. The flaw has a CVE ID.
2. There is reliable evidence it has been actively exploited in the wild.
3. There is a clear remediation action, such as a vendor update.

CISA defines active exploitation as reliable evidence that malicious code ran on a system without the owner’s permission. Scanning, security research and a public proof of concept do not count on their own.

That makes KEV a strong signal and a slow one. An entry means attacks happened. A missing entry does not mean they have not. CISA has to see evidence. The third condition also means a flaw with no clear remediation yet cannot be listed.

Each entry has a date added, a due date and a required action.

BOD 22-01, issued in November 2021, required federal civilian agencies to fix KEV entries by those due dates. CISA now lists it as revoked. According to Tenable, BOD 26-04 replaced it on June 10, 2026, and makes KEV status one of four factors in federal deadlines. None of this binds a nonprofit or a private company. CISA still recommends that every organization use KEV in its prioritization.

Our post on the first MCP flaw in the KEV catalog shows a KEV listing for a newer kind of software.

NVD and its backlog

The National Vulnerability Database is run by NIST. It takes every CVE record and, for many of them, adds its own analysis: a NIST CVSS score, affected product names and weakness types. Many security tools use NVD data, so its gaps can show up in your scans.

That analysis has fallen behind. On April 15, 2026, NIST said CVE submissions rose 263% between 2020 and 2025. NIST enriched nearly 42,000 CVEs in 2025, more than any prior year. Submissions in early 2026 ran nearly a third higher than a year earlier.

So NIST changed its rules. From April 15, 2026, it prioritizes three groups for enrichment:

• CVEs in the KEV catalog, with a goal of one business day.
• CVEs for software used in the federal government.
• CVEs for critical software as defined by Executive Order 14028.

Everything else stays in NVD but is marked lowest priority and not scheduled for immediate enrichment. NIST said it would no longer routinely add its own severity score to those CVEs. Backlogged CVEs published before March 1, 2026 moved to a not-scheduled category.

In our reading, most WordPress and Drupal plugin CVEs fall outside those three groups. Their NVD record will often show only the CNA’s score, or none. That does not mean the flaw is minor. For plugins, read the CNA’s record and the WordPress or Drupal security source.

How to triage a plugin advisory

Most CVE alerts that reach an agency are about plugins, modules or themes. Here is the order we suggest. Each step can end it.

1. Do we run it? Check your plugin inventory across every client site. Include inactive copies. Many alerts stop here.
2. Is our version affected? Compare the installed version with the affected range and the fixed version. Trust the vendor changelog over a summary.
3. Is it being exploited? Check KEV, then Wordfence, Patchstack or WPScan for WordPress, or the advisory for Drupal. Any confirmed attack moves the flaw to the top.
4. Can an attacker reach it? Read the vector. No privileges and a network attack vector on a public form is the worst case. A flaw that needs an admin login is less urgent, unless old accounts linger.
5. What could they do? Code execution or data access outranks a cosmetic bug.
6. Use EPSS to break ties. Between two unexploited flaws, patch the higher EPSS score first.

From those answers, a simple timing rule works for most small teams:

This is our own rule of thumb. Adjust it for each client’s contract and risk. Patching closes the hole but does not remove an attacker who got in first.

Worked example: reading the Bricksforge CVE

Our Bricksforge post covered CVE-2026-85097, a file upload flaw in an add-on for the Bricks WordPress theme. Here is how its numbers read. The values are in the dated table below.

The CNA. Wordfence assigned the ID. Its record describes an unauthenticated arbitrary file upload in versions up to and including 3.1.8.9.

CVSS. Wordfence scored it 9.8 in v3.1. The vector shows network attack, no privileges and no user action. Patchstack scored it 10.0. Both say Critical, so the difference does not change the decision.

Exploitation. Patchstack reported automated attacks starting October 7, 2026, the day before its write-up. That is reliable evidence from a source that watches WordPress traffic.

KEV. The NVD record carried no KEV listing when we checked.

EPSS. About 0.3%, around the 23rd percentile. Taken alone, that says "low priority."

NVD. No NIST score, and a status of Deferred.

Read in the triage order, the answer is plain. Bricksforge 3.1.8.9 or older is exploited, reachable without a login, and gives code execution. Patch today and check for planted files. The low EPSS score and the missing KEV entry pointed the wrong way.

Compare the GlobalProtect flaw in our ransomware post. Every signal agreed: a KEV listing since May 29, EPSS near 97%, and a NIST score of 9.1. The harder cases look like Bricksforge, where the specialist source is ahead of the general ones.

Scores and statuses as of October 2026

Scores change. EPSS updates daily, and NVD and KEV records change as analysis and attacks progress. This table is a snapshot from October 20 and 21, 2026, from NVD records, FIRST’s EPSS data and the vendor pages linked above.

Before you rely on any row, check the live record. A KEV listing or a jump in EPSS can come at any time.

Drupal advisories: a second score to read

Drupal security advisories use their own risk score, not CVSS. The Drupal risk levels page says it is based on NIST’s Common Misuse Scoring System. Six questions add up to 25 points. A score of 15 to 19 is Critical, and 20 or more is Highly critical.

The Drupal vector reads differently from CVSS. A:None means no login is needed. E:Theoretical means no public exploit is known. TD:Default means default or common setups are affected.

Drupal advisories carry CVE IDs too. SA-CORE-2026-014 lists CVE-2026-108097. Our posts on the October 14 core release and 26 module advisories on October 7 show how to read a batch. Our Webform guide explains the score for non-technical readers.

Our guide to what Drupal 10 end of life means for your site covers what to plan before that date.

Where our CVE coverage fits

This guide is the hub for our vulnerability posts. If a colleague asks what is a CVE and why one matters, each of these shows a different part:

• Exploited before the general signals caught up: Bricksforge.
• Scorers who disagree: Ghostscript and PDF uploads.
• Every signal aligned, plus ransomware: GlobalProtect.
• KEV for AI tooling: the MCP authentication flaw.
• Critical CVEs in agent runtimes: agent runtime security.
• Drupal’s own scoring: the October 14 core release.

Frequently Asked Questions