What is CVE Scanner? How CVE Scanning Works

A CVE scanner is a security tool that checks software and systems against a catalog of publicly known vulnerabilities. Each of those vulnerabilities carries a CVE identifier, and the scanner reports which ones are present in an environment.

The process is a matching exercise. The scanner identifies the software and versions running on an asset, then compares them against vulnerability databases, such as the National Vulnerability Database, to identify known flaws.

As a known vulnerability scanner, a CVE scanner finds flaws already disclosed and cataloged. It does not find zero-day flaws that have no CVE yet, which is the one boundary worth stating at the start.

What is a CVE, and How the Pieces Fit

CVE stands for Common Vulnerabilities and Exposures. It is a public catalog that gives every disclosed vulnerability a unique identifier, written in the form CVE-YYYY-NNNNN, so everyone refers to the same flaw by the same name.

Several groups run the system. MITRE operates the CVE program under CISA sponsorship, and more than 400 authorized organizations, called CVE Numbering Authorities, assign the IDs. The National Institute of Standards and Technology runs the National Vulnerability Database (NVD), which enriches each CVE with extra data.

Four acronyms work together. The CVE names the specific flaw. The CWE, or Common Weakness Enumeration, classifies the type of weakness behind it. The CVSS, or Common Vulnerability Scoring System, rates its severity. The CPE, or Common Platform Enumeration, records exactly which product versions it affects.

Each entry maps to real software. CloudSEK's threat intelligence research on CVE-2023-4197 documents one example, a PHP code-injection flaw in Dolibarr ERP/CRM version 18.0.1 that let attackers run their own code on the server.

How a CVE Scanner Works

CVE scanning follows a repeatable sequence. Each stage narrows the picture, moving from finding assets to confirming fixes.

1. Asset Discovery

The scanner first builds a list of the hosts, applications, and software dependencies in scope. It checks only what it knows exists, so this inventory sets the ceiling for everything that follows.

2. Software and Version Identification

The scanner then fingerprints each asset to find the exact products and version numbers running, or reads them from a software bill of materials (SBOM), a formal list of an application's components.

3. Matching Against the CVE Catalog

Using CPE data, the scanner compares each version against known CVEs. A host running baserCMS version 4.7.0, for instance, matches CVE-2023-43792, a code-injection flaw affecting baserCMS 4.6.0 through 4.7.6.

4. Scoring and Prioritization

Each match receives its CVSS severity. Stronger programs add exploitation signals at this stage to decide what matters most, rather than treating every finding alike.

5. Reporting and Rescanning

The scanner lists each finding with remediation guidance. A follow-up scan then confirms the fix, which closes the loop.

Types of CVE Scanning

CVE detection takes several forms. They divide along two lines: how the scanner reaches an asset, and which part of the stack it inspects.

By Access Level

Unauthenticated Scanning

The scanner checks an asset from outside, with no login. It sees what an external attacker sees, which is realistic but shallow.

Authenticated Scanning

The scanner logs in or runs an agent, a small program installed on the host. Reading the exact installed versions makes the results deeper and more accurate.

By Scan Target

Container Image Scanning

The scanner inspects container images before deployment, catching vulnerable packages built into the image.

Software Composition Analysis

This checks the open-source libraries and dependencies an application bundles, matching each one against known CVEs.

External Attack Surface Scanning

This finds an organization's internet-facing assets and flags the ones running software with known CVEs.

Real Problem: More CVEs Than Anyone Can Patch

The catalog grows faster than any team can act on it. More than 40,000 CVEs were published in 2024, up 38 percent from the year before, an average of 108 every day.

Severity scores alone do not solve this. The average CVSS score in 2024 was 6.67, so a scan of any real environment returns hundreds of findings rated medium or high. Treating them all as urgent is impossible.

Most are never used in an attack. Qualys found that only 0.9 percent of 2024's CVEs were weaponized by attackers. The small exploited fraction is what matters, and it moves fast. Wiz reports that 23.6 percent of exploited CVEs are attacked on or before the day they are disclosed.

Some flaws genuinely demand urgent action. CloudSEK's threat intelligence team flagged CVE-2023-42027, a critical cross-site request forgery vulnerability in IBM CICS TX, for immediate patching. Finding CVEs is the easy part. Deciding which ones to fix first is the real work.

CVSS, EPSS, and KEV: Deciding What to Fix First

Three scoring systems help rank what to fix, and each answers a different question. The Common Vulnerability Scoring System rates severity, while two newer signals add the missing context of exploitation.

The distinction is practical. A CVE with a high CVSS score but a near-zero EPSS probability can often wait. A CVE with confirmed active exploitation warrants immediate attention because attackers are using it now. Severity plus exploitability plus exposure beats severity alone.

CVE Scanner vs Vulnerability Scanner

The two terms overlap so much that people use them interchangeably, and for good reason. Most vulnerability scanners work by matching assets against CVE data, so a CVE scan is the core of what they do.

The difference is scope. A CVE scanner focuses on cataloged CVEs and the software versions that carry them. A broader vulnerability scanner extends to issues that never receive a CVE, such as misconfigurations, weak passwords, and exposed services.

A complete program uses both ideas together. It matches assets against the CVE catalog, and it tests for the weaknesses that live outside it.

What CVE Scanning Misses

CVE scanning has clear limits. It cannot find zero-day vulnerabilities, because a flaw with no CVE is not in the catalog to match against. It inherits every gap in that catalog too.

Accuracy depends on the version of the data. Backported patches, where a vendor fixes a flaw without changing the version number, cause false positives, and weak inventory causes misses. Research suggests scanners miss up to 30 percent of known vulnerabilities, depending on how software is packaged. A match is not proof of reach either, since a vulnerable component that an attacker cannot touch ranks lower than its score implies.

How to Perform CVE Scanning Correctly?

A few practices keep CVE scanning focused on real risk rather than raw counts.

1. Build an asset inventory first. Keep a current list of systems and software, ideally with an SBOM, since a scan covers only what it can see.
2. Scan authenticated, not just from outside. Credentialed scans read exact versions and cut both false positives and misses.
3. Scan continuously. New CVEs appear daily, so scanning tied to releases and schedules beats an annual sweep.
4. Prioritize by exploitation, not severity alone. Rank findings using the CISA Known Exploited Vulnerabilities catalog and EPSS probability, rather than the CVSS score by itself.
5. Wire results into patching. Feed findings into patch management and CI/CD pipelines so fixes actually ship.
6. Fix internet-facing exposures first. A known CVE on an internet-facing asset is reachable now, so it goes to the front of the queue.

Find the CVEs Attackers Can Actually Reach with CloudSEK BeVigil

A known CVE becomes a breach only when an attacker can reach the vulnerable software. The internet-facing assets an organization exposes are reachable right now, which makes them the ones to find first.

CloudSEK BeVigil scans for those exposures from the outside. It discovers an organization's internet-facing assets, then flags the ones running software with known CVEs, the same weak points an attacker would probe. Because the view is external, it reaches the forgotten and unmanaged systems that internal scans often skip.

Exposure is only half the answer. CloudSEK Threat Intelligence tracks which CVEs attackers are actively exploiting, so a finding can be ranked by real-world exploitation instead of severity alone. An exposed asset running an exploited CVE is the combination that becomes an incident, and it moves to the top of the list.

Each CVE finding is mapped alongside the exposed services, domains, and cloud assets it affects, giving you a comprehensive picture of your external attack surface. Its primary goal? To instantly surface those forgotten, lingering vulnerabilities before someone else finds them. 

Frequently Asked Questions

What does a CVE scanner do?

A CVE scanner checks software and systems against the catalog of publicly known vulnerabilities. It identifies the versions running on each asset, matches them against CVE records, and reports which known flaws are present.

What is the difference between a CVE and a CVSS score?

A CVE is the unique identifier for a specific vulnerability. A CVSS score is a separate rating, from 0 to 10, that measures how severe the vulnerability is. One names the flaw, the other scores it.

Can a CVE scanner detect zero-day vulnerabilities?

No. A CVE scanner only finds vulnerabilities already published with a CVE identifier. Zero-day flaws have no CVE yet, so they fall outside what CVE scanning can match against.

How often should CVE scanning run?

Continuously, or at least on every release. New CVEs are published daily, around 108 a day in 2024, so scanning tied to CI/CD pipelines catches exposures as software and the catalog changes.

What is the CISA KEV catalog?

The CISA Known Exploited Vulnerabilities catalog is the authoritative list of CVEs confirmed to be exploited in the wild. Security teams use it to prioritize the vulnerabilities attackers are actually using.

Is a CVE scanner the same as a vulnerability scanner?

Mostly. Most vulnerability scanners are CVE-based, so the terms overlap. A CVE scanner centers on cataloged CVEs, while a broader vulnerability scanner flags misconfigurations and exposures that never receive a CVE ID.