Audit and testing
CVE and CVSS
What do CVE and CVSS mean?
A CVE number is the unique name of a publicly known weakness. The CVSS value is a figure for its severity on a scale from 0 to 10.
The name makes sure everyone is talking about the same gap. Manufacturers, testing tools and reports use the same number, in a form such as CVE-2024-12345. Without that shared name there would be no way to tell whether two reports mean the same weakness.
The value places the severity. It takes into account, among other things, whether the gap can be exploited remotely, whether an account is needed for it and what damage it does. The scale runs from 0 to 10, commonly split into low (0.1 to 3.9), medium (4.0 to 6.9), high (7.0 to 8.9) and critical (9.0 to 10.0).
The value alone says nothing about your risk. What decides is whether the affected system runs in your business at all, whether it is reachable from the internet and whether the gap is already being exploited. A finding without that placement is a list, not a result.
All terms in the knowledge base
Note: This entry reflects the state of knowledge to the best of our understanding and serves as general orientation. It is not legal advice. What counts is always the version currently in force at the responsible body, for example dsb.gv.at, nis.gv.at or enisa.europa.eu.
From the term to practice
Where does your business actually stand?
The IT Check reviews your IT across 8 audit areas with more than 100 individual checks and delivers documented findings with a prioritised action plan. From 1,299 € excl. VAT. The first call takes 20 minutes and carries no charge.