Common Vulnerabilities and Exposures (CVE)

The Common Vulnerabilities and Exposures (CVE) programme, operated by MITRE Corporation and funded by the US Cybersecurity and Infrastructure Security Agency (CISA), maintains a public catalogue of individually identified software and hardware vulnerabilities. Each vulnerability receives a CVE ID (e.g. CVE-2024-12345) that serves as a universal reference across vulnerability databases, security tools, and advisories. CVE IDs are assigned by CVE Numbering Authorities (CNAs) — organisations authorised by MITRE to assign IDs within their scope. Large manufacturers (e.g. Microsoft, Siemens) are CNAs for their own products. Smaller manufacturers obtain CVE IDs via the National Vulnerability Database (NVD) or a root CNA.

The CRA requires manufacturers to monitor for vulnerabilities in their products, including in third-party and open-source components (Annex I Part II, §2). CVE is the primary mechanism for this monitoring. Manufacturers must:

• Subscribe to CVE feeds or vulnerability databases for components in their SBOM.
• Assess whether a newly published CVE affects their deployed products.
• Determine if a CVE is actively exploited (triggering the Article 14 24-hour ENISA notification).
• Reference CVE IDs in security advisories and CSAF documents.

When manufacturers publish a patch for a vulnerability they discovered, they should request a CVE ID to ensure the vulnerability is formally tracked in the public record.

Manufacturers that regularly discover and fix vulnerabilities in their own products should consider becoming a CVE Numbering Authority (CNA). CNA status allows a manufacturer to self-assign CVE IDs without waiting for MITRE, which speeds up coordinated disclosure and advisory publication. Requirements include: a functioning PSIRT or equivalent team, a published CVD policy, capacity to respond to CVE-related queries, and agreement to MITRE's CNA Rules. ENISA and the EU regulatory framework treat CNA membership as evidence of a mature vulnerability management programme. Manufacturers with a significant product portfolio or active bug bounty programme will find CNA status particularly valuable.

Manufacturers frequently encounter these problems with CVE:

• Not monitoring third-party component CVEs — a CVE in an embedded OpenSSL version affects the manufacturer's product; ignoring it is a CRA violation.
• Publishing advisories without a CVE ID — an advisory that cannot be cross-referenced with the CVE catalogue is difficult for customers and regulators to action.
• Treating NVD CVSS scores as final — NVD enriches CVE records with CVSS scores, but these are sometimes inaccurate for specific product contexts; manufacturers should score independently.
• Delayed CVE requests — requesting a CVE ID after publishing a patch wastes the coordinated-disclosure window and frustrates customers trying to correlate their patch management data.