Identity and security
CVE
Common Vulnerabilities and Exposures
Common Vulnerabilities and Exposures is a standardised naming system for publicly disclosed software and hardware vulnerabilities, maintained by MITRE under a programme sponsored by the US Department of Homeland Security's CISA.
Why CVE matters in a Microsoft estate
CVE matters because identity, access, endpoint, and data controls shape how Microsoft environments are protected. Readers should understand the term and then be able to move into security assessment, conformity, or remediation guidance.
How CVE shows up in practice
Individual vulnerabilities are assigned a unique identifier in the format CVE-YYYY-NNNNN by an accredited CVE Numbering Authority, which for Microsoft products is generally Microsoft itself, working through its Security Response Center. The identifier's job is deliberately narrow: it provides a single, unambiguous reference for a specific vulnerability so that vendors, researchers, and security tools can all discuss and track the same issue without ambiguity. It carries no severity information on its own, which is why CVEs are almost always paired with a CVSS score, a numeric severity rating from 0 to 10 built from factors like attack complexity, required privileges, and potential impact. That gives organisations a common basis for prioritising remediation across an otherwise unmanageable volume of disclosed vulnerabilities.
In a Microsoft-managed estate, CVE tracking connects directly into the monthly Patch Tuesday cycle, where Microsoft publishes security updates addressing that month's batch of disclosed CVEs affecting Windows, Office, and other Microsoft products, each with its own advisory detailing affected versions, severity, and whether active exploitation has already been observed in the wild. A CVE actively being exploited before or shortly after disclosure is generally referred to as a zero-day, and these carry materially higher urgency than a CVE with no known exploitation, even if their raw CVSS score is similar. Vulnerability management tooling, such as Defender Vulnerability Management within the Defender for Endpoint suite, continuously inventories software versions across managed devices and cross-references them against known CVEs, surfacing which endpoints are actually exposed to a given vulnerability rather than leaving that as a manual spreadsheet exercise.
CISA's Known Exploited Vulnerabilities catalogue adds a further prioritisation layer by explicitly flagging which CVEs have confirmed real-world exploitation, which is often a more actionable signal for triage than CVSS score alone, since a lower-scored CVE under active exploitation is frequently a more urgent remediation priority than a higher-scored one that remains only theoretical. Patch and vulnerability management timeliness is also a direct compliance requirement under frameworks like Cyber Essentials, which specifically expects security updates to be applied within a defined window of release. An organisation's CVE remediation cadence is therefore not purely a technical housekeeping matter, but something that can be checked, questioned, and, in procurement or insurance contexts, required as evidence before a contract or policy is agreed.