CVE and CVSS score

On December 9, 2021, the Log4Shell flaw in the Apache Log4j library went public as CVE-2021-44228, with a CVSS score of 10, the maximum. The two acronyms are read together. CVE (Common Vulnerabilities and Exposures) is the catalog run by MITRE with CISA funding: every public vulnerability gets a unique identifier and a description. CVSS (Common Vulnerability Scoring System), maintained by FIRST, rates severity from 0 to 10 using fixed metrics: attack vector, complexity, privileges and user interaction required, and impact on confidentiality, integrity and availability. Anything from 9.0 to 10 is labeled critical. The score measures technical severity; the likelihood of exploitation lives elsewhere, in CISA's KEV catalog (flaws exploited in the wild) and in FIRST's EPSS score. A 7.5 under mass exploitation matters more than a 9.8 nobody attacks. Patch management triages fixes on those signals. In cyber underwriting, the time to patch critical CVEs is a standard application question, and some carriers scan the applicant's external attack surface: an internet-facing service carrying an unpatched critical CVE can mean a declination, a targeted exclusion or a premium load.