CVE (Common Vulnerabilities and Exposures)
A CVE is a unique public reference number given to a known security flaw, so vendors, scanners and IT teams can all refer to the same problem. The Cyber Essentials documents do not use the term. They set deadlines by severity: fixes for flaws with a CVSS v3 base score of 7 or above are due within 14 days.
- Term
- CVE
- Also known as
- Common Vulnerabilities and Exposures, CVE ID
- Category
- Devices and software
- Requirement area
- 3. Security Update Management
- Questions
- A6.4AUTO-FAILA6.5AUTO-FAIL
- Reviewed against
- Requirements v3.3
What does the term CVE mean in Cyber Essentials?
A CVE is a unique public reference number given to a known security flaw, so vendors, scanners and IT teams can all refer to the same problem.
How does CVE apply to Cyber Essentials?
In plain terms
A CVE number works like a vehicle registration plate for a security flaw. It tells everyone which flaw is being discussed, in the form CVE, then a year, then a sequence number. Like a number plate, it says nothing about how dangerous the flaw is. That comes from a separate score, CVSS, which runs from 0 to 10.
What Cyber Essentials asks
Neither the NCSC requirements nor the Danzell question set mention CVE numbers. What they set is a severity test. An update must be installed within 14 days where it fixes vulnerabilities the vendor calls critical or high risk, where it addresses vulnerabilities "with a CVSS v3 base score of 7 or above", or where the vendor gives no details of the level of vulnerabilities fixed. A6.4 and A6.5 ask about this and are automatic fails on a No.
Vendor security notices and vulnerability scanners usually list each flaw by its CVE number next to its CVSS score, so the CVE is how you find the score you need.
Common mistakes
- Reading only the first CVE in a vendor's notice. The NCSC says that if a single update covers "any ‘critical’ or ‘high risk’ issues then it must be installed within 14 days", so look for the highest score in the list.
- Assuming a fix with no severity rating can wait. Where the vendor gives no details of the level of vulnerabilities fixed, the 14-day rule applies.
See the security update management requirements and Cyber Essentials Plus test 2. Related: CVSS, zero-day, vulnerability fixes.
Related terms
- CVSS (Common Vulnerability Scoring System)CVSS, the Common Vulnerability Scoring System, is the 0 to 10 scale Cyber Essentials uses to define critical and high-risk vulnerabilities.
- Zero-day vulnerabilityA zero-day is a security flaw that attackers know about and can use before the software maker has released a fix, so defenders have had zero days to patch it.
- Vulnerability fixesVulnerability fixes are patches, updates, registry fixes, configuration changes, scripts or any other mechanism approved by the vendor to fix a known vulnerability.
- Device unlockingDevice unlocking is the check, such as a PIN, password, fingerprint or face scan, that a person must pass before they can use a laptop, phone or tablet.
- DevicesDevices, in Cyber Essentials, are all types of hosts, networking equipment, servers, networks and end user devices such as laptops, tablets and smartphones, whether physical or virtual.
- End of support (end of life)End of support is the date after which a vendor stops releasing security fixes for a product, so any new flaws found in it stay open for good.
Frequently asked questions
A CVE is a unique public reference number given to a known security flaw, so vendors, scanners and IT teams can all refer to the same problem.
In the 2026 Danzell question set, CVE comes up at A6.4, A6.5. Read those questions against the definition above so your answers use the term the way the assessor will.
CVE relates to 3. Security Update Management in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.