Common Vulnerabilities and Exposures
Standard public identifier system for disclosed software vulnerabilities.
Joint advisory AA26-281A of 8 October 2026 listed eight exploited CVE identifiers dating from 2014 to 2023, and CISA gave federal agencies until 11 October to fix the five its catalogue did not yet hold.
Last refreshed: 12 October 2026
Who decides which software flaws get a CVE number?
Timeline for Common Vulnerabilities and Exposures
Named as Common Vulnerabilities and Exposures
Cybersecurity: Threats and Defences: Mentioned in: Ten agencies name Beijing firm in hacksNamed as Common Vulnerabilities and Exposures
Cybersecurity: Threats and Defences: Mentioned in: Microsoft fixes 973 flaws in one releaseMentioned in: PaperCut print servers under active attack
Cybersecurity: Threats and DefencesMentioned in: The alert's citations predate the alert
Cybersecurity: Threats and DefencesMentioned in: Arista, Fortinet and Cisco flaws listed
Cybersecurity: Threats and DefencesBackground
Common Vulnerabilities and Exposures gives each publicly disclosed software flaw one shared identifier, written as the prefix CVE, a year and a sequence number, such as CVE-2015-5477 in the BIND name server. Vendors, researchers, governments and patch catalogues use the same number for the same bug, so an allied advisory and CISA's exploited list can be read side by side.
CISA sponsors the CVE Program and MITRE operates it. Identifiers come from CVE Numbering Authorities, 453 of them in April 2025, including vendors such as Microsoft that number flaws in their own products; Microsoft's September 2026 release alone carried 973 of its own identifiers. On 23 April 2025 CISA said a contract issue that had threatened the programme was resolved before any lapse in service.
Allied attribution leans on the CVE system too: advisory AA26-281A, published in October 2026, listed eight exploited CVEs dating from 2014 to 2023.
Old identifiers set a three-day deadline
The 8 October advisory naming Integrity Technology Group cited its flaws by CVE number, and five of those identifiers were new to CISA's exploited catalogue that day: CVE-2015-5477 in BIND, CVE-2015-3306 in ProFTPD, CVE-2016-3081 in Apache Struts, CVE-2021-3199 in ONLYOFFICE Docs and CVE-2023-22894 in Strapi.
CISA had catalogued the Shellshock, Pulse Secure and GitLab flaws from the same advisory before 8 October. Because each bug carried a shared number, a federal agency running any of the five components took its 11 October Deadline straight from an intelligence finding, with no vendor bulletin in between. The oldest pair carry 2015 prefixes, eleven years before the Deadline fell.
Vendors number their own flaws
Microsoft's Patch Tuesday release on 8 September 2026 fixed 973 flaws, every one carrying a CVE number Microsoft issued itself as the numbering authority for its own products. No monthly release since January 2025 had come close; the previous peak, 571, came in July 2026.
September's count measured disclosure rather than danger. Only two of the 973 identifiers carried Microsoft's exploited flag, both Windows privilege-escalation bugs, and CISA gave federal agencies 14 days for each, the longer of its two usual deadlines. A record month of new CVE numbers therefore told defenders little about where attackers were active.