What is a CVE? CVE numbers and CVSS scores explained

WindowsMacUpdated

A CVE is a public reference number for one disclosed security flaw, such as CVE-2026-109618, one of the two PHP flaws known as PHP2Shell. The CVE Program defines a CVE ID as "an alphanumeric string that identifies a Publicly Disclosed vulnerability". A CVSS score is a separate thing: a rating of how severe that flaw is, from 0 to 10. This guide is accurate as of 23 October 2026.

Quick answer

A CVE is a unique ID for one publicly disclosed security flaw, so everyone can refer to the same problem. CVSS is a scoring system that rates the flaw's severity from 0.0 to 10.0. A score of 9.0 or above is rated Critical, so the 9.2 given to both PHP2Shell flaws is Critical.

What is a CVE?

CVE stands for Common Vulnerabilities and Exposures. The CVE Program says its mission is "to identify, define, and catalog publicly disclosed cybersecurity vulnerabilities", and that "there is one CVE Record for each vulnerability in the catalog". Its FAQ describes the CVE ID as the number portion of the record, in the format CVE-YYYY-NNNN.

The point of the number is that people and tools can be sure they mean the same flaw. When the UK's NCSC, the US agency CISA and the PHP project all cite CVE-2026-109619, they are all talking about one specific bug.

Who gives a flaw its CVE number?

An organisation called a CVE Numbering Authority, or CNA. The CVE Program defines a CNA as an authorised body that is responsible for assigning CVE IDs and publishing the matching CVE Records within its own scope.

For PHP2Shell, the CNA was the PHP project itself. The official CVE records for both PHP2Shell flaws name the PHP project as the assigner, and show it reserved both IDs on 12 October 2026 and published the records on 21 October, the day the fixes came out.

Does a CVE number tell you how serious a flaw is?

No. The number is only an identifier. The CVE Program's FAQ says the record format "enables CNAs to include CVSS or other severity rating scores" in their records when they publish them. So the score comes from whoever writes it, which is where CVSS comes in.

What is CVSS?

CVSS is the Common Vulnerability Scoring System, owned and managed by FIRST, which its specification describes as a US-based non-profit whose mission is to help computer security incident response teams across the world. FIRST's version 4.0 specification says CVSS "captures the principal technical characteristics" of vulnerabilities, and that its outputs include "numerical scores indicating the severity of a vulnerability relative to other vulnerabilities".

The headline number is usually the Base score, which runs from 0.0 to 10.0. It comes with a vector string, a short code recording each choice behind the score. For both PHP2Shell flaws it reads CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. AV:N means the flaw can be attacked over a network, PR:N that no login is needed, and VC:H, VI:H and VA:H that the impact on the vulnerable system is High. FIRST requires anyone publishing a CVSS score to give the vector string too, so others can see how it was reached.

Our guide to remote code execution explains what those impact ratings mean in practice.

What does a CVSS score of 9.2 mean?

It means Critical. FIRST's specification maps every CVSS score to a severity rating, and the US National Vulnerability Database (NVD) uses the same bands:

  • None: 0.0
  • Low: 0.1 to 3.9
  • Medium: 4.0 to 6.9
  • High: 7.0 to 8.9
  • Critical: 9.0 to 10.0

The PHP project rated both PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, at 9.2 under CVSS v4.0, which puts them in the Critical band. FIRST says the bands are there to help organisations "properly assess and prioritize their vulnerability management processes".

Why isn't the score the whole story?

Because the Base score measures how severe a flaw is, not the risk it poses to you. The NVD says plainly that "CVSS is not a measure of risk". FIRST's user guide says Base scores "are designed to measure the severity of a vulnerability and should not be used alone to assess risk".

CVSS v4.0 has other metric groups for that. The Threat metrics adjust a score for things like "the availability of proof-of-concept code or active exploitation", and the Environmental metrics reflect a particular organisation's own systems. FIRST says Threat and Environmental information is available only to the organisations using the software, which should add it to the Base metrics to get a score specific to them. The NVD says it provides assessments of Base metrics only.

There's also the question of who did the scoring. For PHP2Shell, three official sources give different numbers:

  • The PHP project: 9.2, Critical, for both flaws, under CVSS v4.0.
  • The NVD's own assessment under CVSS v3.1: 9.8, Critical, for CVE-2026-109618, and 8.1, High, for CVE-2026-109619. As of 23 October 2026 the NVD shows no v4.0 assessment of its own.
  • Synology's advisory Synology-SA-26:14: a CVSS3 Base Score of 9.8, Critical, for both flaws.

The vector strings show where they differ. For CVE-2026-109619, the NVD marks attack complexity as High and Synology marks it as Low. None of the three puts either flaw below High, and the PHP project's advice for both is to update.

More questions

What does CVE stand for?

Common Vulnerabilities and Exposures. The CVE Program, which runs the list, is described on its own site as an international, community-driven effort to identify and catalog publicly disclosed vulnerabilities.

Is a critical vulnerability an emergency for me?

Only if you run the affected software. A Critical rating describes the flaw, and the NVD says CVSS is not a measure of risk. For PHP2Shell that means people who run websites or devices using PHP. Our guide to checking your website's PHP version shows where to look.

What's the difference between CVSS 3.1 and 4.0?

The NVD says CVSS v3.x has three metric groups (Base, Temporal and Environmental), while v4.0 has four (Base, Threat, Environmental and Supplemental). The severity bands for Low, Medium, High and Critical are the same in both.

Where can I look up a CVE number?

On cve.org, which holds the official CVE Records, and on the NVD at nvd.nist.gov. The NVD says it provides CVSS enrichment for all published CVE records, and its pages show scores from both the NVD and the CNA.

Is a CVE the same as a vulnerability?

Not quite. The vulnerability is the flaw itself, and the CVE ID is the label for it. Our guide to what a vulnerability is covers the flaw side.

Sources