--- title: "CVE, Common Vulnerabilities and Exposures | MedTech Terms" description: "A globally unique identifier for a publicly disclosed cybersecurity vulnerability. Plain-English Cybersecurity definition for MedTech teams, with examples and r" lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/cve#term", "name": "Common Vulnerabilities and Exposures", "alternateName": "CVE", "description": "Common Vulnerabilities and Exposures (CVE) is a public catalog of disclosed cybersecurity vulnerabilities, each assigned a unique CVE ID (e.g., CVE-2024-12345). The program is operated by MITRE and sponsored by CISA. CVE IDs are the lingua franca of vulnerability management - they let manufacturers, hospitals, researchers, and security tooling refer to the same vulnerability unambiguously across SBOMs, advisories, vulnerability scanners, and patch notes.", "url": "https://medtechterms.com/terms/cve", "termCode": "cve", "inDefinedTermSet": { "@type": "DefinedTermSet", "name": "MedTech Terms", "url": "https://medtechterms.com/terms" } }, { "@type": "Article", "@id": "https://medtechterms.com/terms/cve#article", "headline": "CVE, Common Vulnerabilities and Exposures", "description": "A globally unique identifier for a publicly disclosed cybersecurity vulnerability.", "url": "https://medtechterms.com/terms/cve", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://medtechterms.com/terms/cve" }, "about": { "@id": "https://medtechterms.com/terms/cve#term" }, "articleSection": "Cybersecurity", "inLanguage": "en", "keywords": "Common Vulnerabilities and Exposures, CVE, Cybersecurity, medical device, MedTech", "author": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://bluegoatcyber.com" }, "publisher": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "isPartOf": { "@type": "WebSite", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "datePublished": "2026-05-05", "dateModified": "2026-05-05", "citation": [ { "@type": "CreativeWork", "name": "CVE.org", "url": "https://www.cve.org/", "publisher": { "@type": "Organization", "name": "MITRE" } }, { "@type": "CreativeWork", "name": "National Vulnerability Database (NVD)", "url": "https://nvd.nist.gov/", "publisher": { "@type": "Organization", "name": "NIST" } }, { "@type": "CreativeWork", "name": "CISA Known Exploited Vulnerabilities Catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "publisher": { "@type": "Organization", "name": "CISA" } } ], "mentions": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/cvss#term", "name": "Common Vulnerability Scoring System", "alternateName": "CVSS", "url": "https://medtechterms.com/terms/cvss" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/sbom#term", "name": "Software Bill of Materials", "alternateName": "SBOM", "url": "https://medtechterms.com/terms/sbom" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/vex#term", "name": "Vulnerability Exploitability eXchange", "alternateName": "VEX", "url": "https://medtechterms.com/terms/vex" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/cvd#term", "name": "Coordinated Vulnerability Disclosure", "alternateName": "CVD", "url": "https://medtechterms.com/terms/cvd" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/patchability#term", "name": "Patchability", "url": "https://medtechterms.com/terms/patchability" } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Terms", "item": "https://medtechterms.com/terms" }, { "@type": "ListItem", "position": 3, "name": "Cybersecurity", "item": "https://medtechterms.com/terms?cat=Cybersecurity" }, { "@type": "ListItem", "position": 4, "name": "Common Vulnerabilities and Exposures", "item": "https://medtechterms.com/terms/cve" } ] }, { "@type": "FAQPage", "@id": "https://medtechterms.com/terms/cve#faq", "mainEntity": [ { "@type": "Question", "name": "What's the difference between CVE, CVSS, and CWE?", "acceptedAnswer": { "@type": "Answer", "text": "CVE is the unique identifier for a specific vulnerability instance. CVSS is a 0–10 severity score. CWE (Common Weakness Enumeration) classifies the underlying type of weakness (e.g., CWE-79 cross-site scripting). All three are MITRE-coordinated programs." } }, { "@type": "Question", "name": "Where do CVEs come from?", "acceptedAnswer": { "@type": "Answer", "text": "CNAs (CVE Numbering Authorities) - including MITRE, vendors, CERT/CC, and security researchers - request and assign CVE IDs. The National Vulnerability Database (NVD) at NIST then enriches each CVE with CVSS scoring and CPE metadata." } }, { "@type": "Question", "name": "Does our device need its own CNA?", "acceptedAnswer": { "@type": "Answer", "text": "Not unless you frequently disclose vulnerabilities in your own products. Most MedTech manufacturers coordinate disclosure through MITRE's root CNA or via CERT/CC." } } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About 1. [Home](/) 2. / 3. [Terms](/terms) 4. / 5. [Cybersecurity](/terms?cat=Cybersecurity) 6. / 7. Common Vulnerabilities and Exposures [All terms](/terms) Cybersecurity [Connected & Cyber-Physical Devices](/ecosystems/connected-devices)CVE # Common Vulnerabilities and Exposures A globally unique identifier for a publicly disclosed cybersecurity vulnerability. Reviewed by [Christian Espinosa, Founder, Blue Goat Cyber](/authors/christian-espinosa) Last reviewed May 5, 2026 ## Definition Common Vulnerabilities and Exposures (CVE) is a public catalog of disclosed cybersecurity vulnerabilities, each assigned a unique CVE ID (e.g., CVE-2024-12345). The program is operated by MITRE and sponsored by CISA. CVE IDs are the lingua franca of vulnerability management - they let manufacturers, hospitals, researchers, and security tooling refer to the same vulnerability unambiguously across SBOMs, advisories, vulnerability scanners, and patch notes. What the regulation says FDA expects manufacturers to monitor CVEs against the components in their [SBOM](/terms/sbom) as a continuous post-market activity, and to assess each CVE's exploitability in their device using a [VEX](/terms/vex) document or equivalent. CISA's [Known Exploited Vulnerabilities](/terms/kev) (KEV) catalog flags CVEs with confirmed in-the-wild exploitation; CVEs on the KEV list typically warrant accelerated triage. ICS-CERT (now part of CISA) issues medical-device-specific advisories that reference CVE IDs. ## What this means in practice Modern MedTech vulnerability programs ingest CVE feeds (NVD, OSV.dev, vendor advisories) automatically, match them against each device's [SBOM](/terms/sbom), and route confirmed-applicable CVEs into the existing [CAPA](/terms/capa) or [post-market surveillance](/terms/post-market-surveillance) workflow. [VEX](/terms/vex) statements communicate exploitability decisions to operators so hospitals don't have to triage every CVE themselves. Common pitfalls - • Treating CVSS score alone as the prioritization signal - exploitability and reachability matter more than headline severity. - • Manually tracking CVEs without automation against the SBOM - humans miss them. - • Failing to publish VEX statements, leaving hospitals to assume every CVE in the SBOM is exploitable. ## Frequently asked questions What's the difference between CVE, CVSS, and CWE? CVE is the unique identifier for a specific vulnerability instance. [CVSS](/terms/cvss) is a 0–10 severity score. [CWE](/terms/cwe) (Common Weakness Enumeration) classifies the underlying type of weakness (e.g., CWE-79 cross-site scripting). All three are MITRE-coordinated programs. Where do CVEs come from? Does our device need its own CNA? ## Cross-references ### Uses Concepts or artefacts this term builds on. - [ Common Vulnerability Scoring System(CVSS) ](/terms/cvss) ## Related terms Grouped by theme ### Editor's picks · Hand-selected related concepts [ Cybersecurity Common Vulnerability Scoring System(CVSS) An industry-standard 0–10 score that quantifies the severity of a software vulnerability. ](/terms/cvss)[ Cybersecurity Vulnerability Exploitability eXchange(VEX) A machine-readable statement that explains whether a known vulnerability is actually exploitable in a specific product. ](/terms/vex)[ Cybersecurity Software Bill of Materials(SBOM) A machine-readable inventory of all software components, including open-source and third-party libraries, used to build a medical device. ](/terms/sbom)[ Cybersecurity Coordinated Vulnerability Disclosure(CVD) A documented process for receiving, triaging, and responsibly disclosing security vulnerabilities reported by external researchers. ](/terms/cvd) ### FDA Cybersecurity 101 · From this learning path [ Cybersecurity CycloneDX A lightweight, OWASP-maintained SBOM format designed for application security and supply-chain use cases. ](/terms/cyclonedx?from=fda-cybersecurity-101)[ Cybersecurity Premarket Cybersecurity Submission The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device. ](/terms/premarket-cybersecurity?from=fda-cybersecurity-101)[ Cybersecurity Section 524B of the FD&C Act(524B) The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices. ](/terms/section-524b?from=fda-cybersecurity-101)[ Cybersecurity Secure Product Development Framework(SPDF) A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle. ](/terms/spdf?from=fda-cybersecurity-101) Cited by Where this term appears across MedTech Terms. Learning paths (1) - [FDA Cybersecurity 101](/paths/fda-cybersecurity-101)Lesson 9 of 11 Ecosystems (1) - [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) ## Primary references 3 sources Link health: 3 verified · last checked 2026-06-20 MITRE· 1 NIST· 1 CISA· 1 1. [1 CVE.org Verified MITRE · cve.org ](https://www.cve.org/) 2. [2 National Vulnerability Database (NVD) Verified NIST · nvd.nist.gov ](https://nvd.nist.gov/) 3. [3 CISA Known Exploited Vulnerabilities Catalog Verified CISA · cisa.gov ](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) Inline markers like \[1\] jump to the matching reference above. Sponsor note ### Working on medical device cybersecurity? Blue Goat Cyber specializes in MedTech cybersecurity - threat modeling, SBOMs, penetration testing, and FDA premarket submissions. [Book a 30-minute discovery session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) - No obligation - Expert-led from minute one - NDA available on request MedTech Terms is a community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com). Definitions are independent of any vendor. On this term Category Cybersecurity Acronym CVE Sources 3 Updated 5/5/2026 [Compare with another term](/compare?a=cve) Learn in 60 seconds Card Lesson Quiz A globally unique identifier for a publicly disclosed cybersecurity vulnerability. - · VEX statements communicate exploitability decisions to operators so hospitals don't have to triage every CVE themselves. - · The program is operated by MITRE and sponsored by CISA. Remember this Watch out: Treating CVSS score alone as the prioritization signal - exploitability and reachability matter more than headline severity. Related terms - [Common Vulnerability Scoring System(CVSS) ](/terms/cvss) - [Software Bill of Materials(SBOM) ](/terms/sbom) - [Vulnerability Exploitability eXchange(VEX) ](/terms/vex) - [Coordinated Vulnerability Disclosure(CVD) ](/terms/cvd) - [Patchability ](/terms/patchability) You may also need Auto-suggested from Cybersecurity and shared keywords. - [CISA Known Exploited Vulnerabilities Catalog(KEV) ](/terms/kev) - [AAMI TIR97(TIR97) ](/terms/aami-tir97) - [ICS Medical Advisory(ICSMA) ](/terms/ics-medical-advisory) - [AAMI SW96 ](/terms/aami-sw96) - [Health Information Sharing and Analysis Center(H-ISAC) ](/terms/h-isac) - [MITRE ATT&CK(ATT&CK) ](/terms/mitre-attack) [All Cybersecurity terms](/terms?cat=Cybersecurity) From the Blue Goat network Related resources and services on this topic. - [ MedTech Cyber Tips Practical, organized tips for medical device cybersecurity teams. ](https://medtechcybertips.com) - [ Code Blue Real medical device cybersecurity incidents and their lessons. ](https://codebluechart.com) - [ MedTech Cybersecurity Standards Authoritative reference for the standards and guidances behind medical device cybersecurity. ](https://medtechcyberstandards.com) - [ MedTech Cybersecurity Crosswalk International crosswalk of medical device cybersecurity requirements across regulators. ](https://mdccrosswalk.com) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)