CVE, CVSS and KEV mean different things
CVE is a system of identifiers and public records for known vulnerabilities. CVE-YEAR-NUMBER lets tools and vendor advisories refer to the same issue; the year is not necessarily the year of discovery.
- CVE identifies the issue. Its record and references help locate affected products and versions.
- CVSS expresses technical severity through a score and vector. It is not, alone, the probability of an attack against your system.
- CISA KEV lists vulnerabilities with evidence of real exploitation under CISA’s criteria. It does not necessarily cover every exploited vulnerability.
Check whether a CVE affects your server
Compare product, version, configuration and advisory conditions with your inventory. Check Linux distribution advisories too: fixes may be backported to older versions, making the version number alone misleading.
Verify an irrelevant finding rather than dismissing it by default. Obermon lets you mark a vulnerability as a false positive and retain who decided, when and why. An inventory with no findings does not prove the system has no unknown vulnerabilities.
A practical order for triage
First check applicability. Then look for exploitation evidence, assess exposure and impact, and check the vendor’s patch or mitigations.
- Already exploited: promptly assess exposure and remediation; do not rely solely on the score.
- Critical with a fix available: plan a timely update and verification.
- Other cases: maintain a work list, assess context and revisit vendor advisories.
How Obermon uses this information
Daily checks compare software installed on servers and in containers with known vulnerabilities and show what to update. Alerts are reserved for exploited issues or critical issues with an available fix.
Open, acknowledged, false positive, mitigated and resolved states help track decisions. A mitigation is not necessarily a permanent fix: reassess risk and verify the outcome after intervention.
Sources and further reading
This information does not replace a technical or legal assessment of your circumstances.