Common Vulnerabilities and Exposures
A globally unique identifier for a publicly disclosed cybersecurity vulnerability.
Definition
Common Vulnerabilities and Exposures (CVE) is a public catalog of disclosed cybersecurity vulnerabilities, each assigned a unique CVE ID (e.g., CVE-2024-12345). The program is operated by MITRE and sponsored by CISA. CVE IDs are the lingua franca of vulnerability management - they let manufacturers, hospitals, researchers, and security tooling refer to the same vulnerability unambiguously across SBOMs, advisories, vulnerability scanners, and patch notes.What this means in practice
Modern MedTech vulnerability programs ingest CVE feeds (NVD, OSV.dev, vendor advisories) automatically, match them against each device's SBOM, and route confirmed-applicable CVEs into the existing CAPA or post-market surveillance workflow. VEX statements communicate exploitability decisions to operators so hospitals don't have to triage every CVE themselves.Examples
- A MedTech manufacturer learns of a new CVE affecting a third-party library used in their infusion pump software through an automated feed. They then update their SBOM to reflect the vulnerability and begin assessing its impact on patient safety and device functionality.
- A hospital's cybersecurity team receives an alert about a recently disclosed CVE that impacts the operating system of their medical imaging workstations. They consult the manufacturer's VEX statement to determine if their specific configurations are exploitable and plan remediation steps.
- During a pre-market cybersecurity assessment, a regulatory body reviews a device's security documentation, including its SBOM, and identifies several CVEs present in its software components. The manufacturer must then provide a plan to mitigate these vulnerabilities before market approval.
- •Treating CVSS score alone as the prioritization signal - exploitability and reachability matter more than headline severity.
- •Manually tracking CVEs without automation against the SBOM - humans miss them.
- •Failing to publish VEX statements, leaving hospitals to assume every CVE in the SBOM is exploitable.
Frequently asked questions
Cross-references
Related terms
Grouped by themeEditor's picks
· Hand-selected related conceptsAn industry-standard 0–10 score that quantifies the severity of a software vulnerability.
A machine-readable statement that explains whether a known vulnerability is actually exploitable in a specific product.
A machine-readable inventory of all software components, including open-source and third-party libraries, used to build a medical device.
A documented process for receiving, triaging, and responsibly disclosing security vulnerabilities reported by external researchers.
FDA Cybersecurity 101
· From this learning pathA lightweight, OWASP-maintained SBOM format designed for application security and supply-chain use cases.
The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device.
The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices.
A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle.
Where this term appears across MedTech Terms.
- FDA Cybersecurity 101Lesson 9 of 11
Latest in MedTech
Sources
3 sourcesEvery citation below opens the original document. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.
- 1CVE.orgTier 2 VerifiedMITREcve.org
- 2National Vulnerability Database (NVD)Tier 2 VerifiedNISTnvd.nist.gov
- 3CISA Known Exploited Vulnerabilities CatalogTier 2 VerifiedCISAcisa.gov
Inline markers like [1] jump to the matching reference above.