CVE

CVE stands for Common Vulnerabilities and Exposures. It is a program, launched in 1999, that assigns a unique ID to each publicly disclosed cybersecurity vulnerability. IDs are issued by CVE Numbering Authorities (CNAs) — software vendors, research organisations and coordination centres authorised by the CVE Program — for example CVE-2021-44228, the Log4Shell flaw in Apache Log4j.

A CVE identifies a vulnerability; CVSS (Common Vulnerability Scoring System) rates how severe it is on a 0–10 scale. One CVE can carry several CVSS scores from different sources, such as the vendor and the US National Vulnerability Database (NVD). Neither predicts how likely exploitation is, which is why teams add EPSS and the CISA KEV catalogue when prioritising fixes.

For vehicles, CVEs are handled through the vulnerability-management activities of ISO/SAE 21434 Clause 8. Each ECU's software bill of materials (SBOM) is matched against new CVEs, relevant matches are analysed for exploitability in the vehicle's architecture, and confirmed weaknesses feed back into the TARA, patch planning and, where needed, incident response under UNECE R155.