CVE

CVE identifiers are assigned by CVE Numbering Authorities against a defined scope: one identifier per distinct vulnerability, in a defined product or set of products, with a description that allows it to be distinguished from related issues. The identifier itself carries no severity information; severity is typically expressed separately, for example through CVSS scoring.

Why the identifier matters operationally

A CVE reference is what lets an SBOM, a vulnerability scanner, a supplier advisory and an internal ticket all refer to the same underlying issue without ambiguity. Without it, correlating a component vulnerability across multiple products and multiple suppliers becomes a manual, error-prone exercise, which is exactly the situation a 24-hour reporting clock does not tolerate.

• SBOM tooling matches component versions against CVE databases to flag known vulnerabilities automatically.
• Coordinated disclosure processes typically request or assign a CVE before public release of details.
• Reporting obligations under the CRA reference the underlying vulnerability, not the CVE identifier itself, but the identifier is how the vulnerability is tracked in practice.

A vulnerability affecting your product may not yet have a CVE at the point you learn of it — assignment can lag disclosure. Vulnerability handling processes need to work from the underlying technical detail, not assume an identifier will already exist.