The Reality of CVEs: A useful but imperfect system

Modern software evolves constantly—new features, improvements, and bug fixes roll out every day. But with millions of lines of code in modern applications, mistakes are inevitable. Some of these mistakes lead to security vulnerabilities that can be used by malicious parties, to, for example, steal data or deploy ransomware. When these vulnerabilities are officially tracked, either because they are reported by the company itself or by independent security researchers (ethical hackers), they get assigned a Common Vulnerabilities and Exposures (CVE) identifier.

The Value of CVEs

Despite their imperfections, CVEs play a crucial role in cybersecurity. They provide a standardized way to track and communicate known vulnerabilities, helping security teams prioritize fixes and mitigate risks efficiently. Without CVEs, it would be much harder to coordinate responses across different organizations, vendors, and security researchers. They also serve as an essential reference point for security tools, compliance frameworks, and vulnerability management programs. While they don’t cover every risk, CVEs are a key part of a proactive security strategy, making it easier for organizations and individuals to stay informed and take action.

But while CVEs are useful, they’re far from perfect.

1. Not all vulnerabilities become CVEs

A potential misconception is that every security flaw gets a CVE. In reality, most vulnerabilities never get one. CVEs go through a formal review and registration process, which takes time and effort. Many issues remain undocumented, either because they weren’t (properly) reported, didn’t meet CVE criteria, or were quietly fixed by developers before they ever became public.

This means only tracking CVEs gives a false sense of security—a CVE-free system doesn’t mean it’s vulnerability-free.

2. Not all CVEs are useful (or even true)

Just because a CVE exists doesn’t mean it’s relevant or even valid. The CVE system has its shortcomings:

• Duplicate or vague reports – Some CVEs describe broad or unclear issues, making it hard to assess real-world impact.
• Low-risk findings – Not all CVEs are critical. Some might require unrealistic attack scenarios or only apply in niche environments.
• Misclassified or incorrect CVEs – Mistakes happen. Sometimes CVEs are later revised or rejected, but the initial impact on the software developer or users remains. Moreover, for security researchers it is sometimes about the fame of reporting a CVE, incentivizing the report of incorrect or small vulnerabilities.

Security teams often have to filter through noise to determine which CVEs actually matter.

3. CVEs alone are a low bar for security

Relying only on CVEs for security is like locking your front door but leaving the windows open. CVEs help highlight known risks, but they don’t cover everything.

• Zero-days (unknown vulnerabilities) – Some of the most dangerous flaws don't have CVEs because they haven't been disclosed yet. Attackers can exploit them before a fix exists.
• Unsupported software – Older, unmaintained software might not receive CVEs, even if it's full of security holes. If it's not getting updates, it's a risk—whether or not there's a CVE attached.
• Misconfigurations and logic flaws – Many security issues stem from how software is set up and used, not just from code vulnerabilities. Poor permissions, exposed databases, or weak authentication often cause real-world breaches.

A security strategy focused only on CVEs is incomplete. You need a broader risk management approach.

So, What’s the Takeaway?

1. Always update your software – Not all vulnerabilities get CVEs, so don’t wait for one to appear before patching.
2. Use CVEs for prioritization, not as a complete security checklist – They’re helpful but not the full picture.
3. Be aware of risks beyond CVEs – Unsupported software, misconfigurations, and zero-days matter just as much.

CVEs are an important tool, but they’re just one piece of the puzzle. Security isn’t about checking boxes—it’s about knowing your risks and staying proactive.