{"id":3666,"date":"2026-08-17T11:27:39","date_gmt":"2026-08-17T11:27:39","guid":{"rendered":"https:\/\/mscyber.tech\/?p=3666"},"modified":"2026-08-17T11:28:46","modified_gmt":"2026-08-17T11:28:46","slug":"o-que-e-um-cve","status":"publish","type":"post","link":"https:\/\/mscyber.tech\/pt\/o-que-e-um-cve\/","title":{"rendered":"O que \u00e9 uma CVE? Vulnerabilidades e Exposi\u00e7\u00f5es Comuns"},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\n\t\t\t\t\t\tDefini\u00e7\u00e3o: <\/span>\n\t\t\t\n\t\t\t\t\t\tUma CVE (Common Vulnerabilities and Exposures) \u00e9 um identificador p\u00fablico padronizado atribu\u00eddo a uma vulnerabilidade de seguran\u00e7a conhecida espec\u00edfica. Cada registro CVE possui um ID exclusivo no formato CVE-AAAA-NNNNN, uma descri\u00e7\u00e3o e refer\u00eancias. O sistema \u00e9 mantido pelo MITRE, patrocinado pela ag\u00eancia norte-americana CISA, e fornece a toda a ind\u00fastria um nome compartilhado para a mesma falha.<\/span>\n\t\t\t\n\t\t\t\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

O sistema CVE existe para resolver um problema de coordena\u00e7\u00e3o que antes tornava a gest\u00e3o de vulnerabilidades quase imposs\u00edvel. Antes dele, dois fornecedores podiam descrever a mesma falha com palavras completamente diferentes, de modo que um defensor n\u00e3o tinha uma maneira confi\u00e1vel de saber se dois avisos se referiam a uma vulnerabilidade ou a duas. Um CVE resolve isso dando a cada vulnerabilidade conhecida um nome \u00fanico e inequ\u00edvoco que todos usam, desde pesquisadores e fornecedores at\u00e9 as ferramentas que vasculham sua rede. Este guia explica como o sistema funciona, como um CVE passa pelo seu ciclo de vida, como ele difere das pontua\u00e7\u00f5es e cat\u00e1logos com os quais \u00e9 frequentemente confundido, e como usar CVEs de fato em um programa de seguran\u00e7a.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

Como funciona o sistema CVE<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Um identificador CVE \u00e9 atribu\u00eddo por um CNA (Autoridade de Numera\u00e7\u00e3o de CVE)<\/strong>, uma organiza\u00e7\u00e3o autorizada pelo CVE Program a alocar IDs dentro de seu escopo. Muitos grandes fornecedores de tecnologia s\u00e3o CNAs para seus pr\u00f3prios produtos, o que lhes permite atribuir um CVE no momento em que confirmam uma vulnerabilidade. A MITRE opera o programa e atua como coordenadora de n\u00edvel superior, enquanto a CISA o patrocina. Essa estrutura federada \u00e9 o que permite que o sistema seja dimensionado para dezenas de milhares de novos CVEs a cada ano.<\/p>

Vale a pena ser preciso sobre o que uma CVE \u00e9 e n\u00e3o \u00e9. Uma CVE \u00e9 um identificador e uma breve descri\u00e7\u00e3o. Ela n\u00e3o \u00e9 uma pontua\u00e7\u00e3o de gravidade, n\u00e3o \u00e9 um banco de dados de detalhes de explora\u00e7\u00e3o e n\u00e3o \u00e9 uma corre\u00e7\u00e3o. Essas fun\u00e7\u00f5es pertencem a outros sistemas constru\u00eddos sobre a CVE, descritos abaixo.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

A anatomia de um identificador CVE<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

O formato \u00e9 deliberadamente simples para que um ser humano ou uma m\u00e1quina possa analis\u00e1-lo instantaneamente:<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\r\n\r\n\r\n\r\n\r\nAnatomia de um identificador CVE (responsivo)<\/title>\r\n<style>\r\n \/* Paste from .ms-table-wrap down into your CMS. The .ms- prefix keeps it isolated from blog styles. *\/\r\n body { margin: 40px; background: #ffffff; }\r\n\r\n .ms-table-wrap {\r\n max-width: 620px;\r\n font-family: -apple-system, \"Segoe UI\", Roboto, \"Helvetica Neue\", Arial, sans-serif;\r\n color: #3f3f46;\r\n -webkit-font-smoothing: antialiased;\r\n }\r\n\r\n .ms-table {\r\n width: 100%;\r\n border-collapse: separate;\r\n border-spacing: 0;\r\n border: 1px solid #e5e7eb;\r\n border-radius: 10px;\r\n overflow: hidden;\r\n font-size: 15px;\r\n line-height: 1.5;\r\n }\r\n\r\n \/* Header: black bar, white bold text *\/\r\n .ms-table thead th {\r\n background: #1c1c1e;\r\n color: #ffffff;\r\n font-weight: 600;\r\n text-align: left;\r\n padding: 15px 22px;\r\n white-space: nowrap;\r\n }\r\n\r\n \/* Body cells *\/\r\n .ms-table tbody td,\r\n .ms-table tbody th {\r\n padding: 15px 22px;\r\n text-align: left;\r\n vertical-align: top;\r\n border-top: 1px solid #ececee;\r\n }\r\n\r\n \/* First column: teal, bold (row header) *\/\r\n .ms-table tbody th {\r\n font-weight: 700;\r\n color: #14808f;\r\n width: 130px;\r\n white-space: nowrap;\r\n }\r\n\r\n \/* Vertical divider *\/\r\n .ms-table tbody td { border-left: 1px solid #ececee; }\r\n .ms-table thead th + th { border-left: 1px solid #33333a; }\r\n\r\n \/* Zebra striping *\/\r\n .ms-table tbody tr:nth-child(odd) th,\r\n .ms-table tbody tr:nth-child(odd) td { background: #f5f6f7; }\r\n .ms-table tbody tr:nth-child(even) th,\r\n .ms-table tbody tr:nth-child(even) td { background: #ffffff; }\r\n\r\n \/* Responsive: short two-column table, so it stays a compact grid and\r\n simply tightens up on small screens instead of reflowing into cards. *\/\r\n @media (max-width: 600px) {\r\n .ms-table-wrap { max-width: 100%; }\r\n .ms-table { font-size: 14px; }\r\n .ms-table thead th,\r\n .ms-table tbody td,\r\n .ms-table tbody th { padding: 12px 16px; }\r\n .ms-table tbody th { width: 38%; }\r\n }\r\n<\/style>\r\n<\/head>\r\n<body>\r\n\r\n<div class=\"ms-table-wrap\">\r\n <table class=\"ms-table\">\r\n <thead>\r\n <tr>\r\n <th scope=\"col\">Parte<\/th>\r\n <th scope=\"col\">Significado<\/th>\r\n <\/tr>\r\n <\/thead>\r\n <tbody>\r\n <tr>\r\n <th scope=\"row\">CVE<\/th>\r\n <td>O prefixo fixo que identifica a norma<\/td>\r\n <\/tr>\r\n <tr>\r\n <th scope=\"row\">AAAA<\/th>\r\n <td>O ano em que o ID foi reservado ou atribu\u00eddo<\/td>\r\n <\/tr>\r\n <tr>\r\n <th scope=\"row\">NNNNN<\/th>\r\n <td>Um n\u00famero de sequ\u00eancia exclusivo, de comprimento vari\u00e1vel<\/td>\r\n <\/tr>\r\n <\/tbody>\r\n <\/table>\r\n<\/div>\r\n\r\n<\/body>\r\n<\/html>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b079613 elementor-widget elementor-widget-text-editor\" data-id=\"b079613\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p>Um identificador como CVE-2021-44228 aponta para exatamente uma vulnerabilidade, e qualquer pessoa no mundo pode consult\u00e1-lo e saber exatamente a qual falha ele se refere. Essa universalidade \u00e9 todo o valor do sistema.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-10b5b1c elementor-widget elementor-widget-heading\" data-id=\"10b5b1c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">O ciclo de vida do CVE<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-31abef5 elementor-widget elementor-widget-text-editor\" data-id=\"31abef5\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p>Um registro CVE passa por estados definidos, e conhec\u00ea-los ajuda uma equipe a interpretar o que um determinado identificador realmente lhes diz em um determinado momento.<\/p><p>Primeiro, um ID pode ser <strong>Reservado<\/strong> por uma CNA, o que significa que o n\u00famero \u00e9 alocado, mas os detalhes ainda n\u00e3o s\u00e3o p\u00fablicos, frequentemente durante uma divulga\u00e7\u00e3o coordenada enquanto uma corre\u00e7\u00e3o est\u00e1 sendo preparada. Em seguida, o CVE \u00e9 <strong>publicado<\/strong>, o que significa que a descri\u00e7\u00e3o e as refer\u00eancias se tornam p\u00fablicas. Por fim, o registro \u00e9 <strong>enriquecido<\/strong> no National Vulnerability Database, onde os analistas adicionam pontua\u00e7\u00e3o de gravidade e metadados adicionais. Uma CVE rec\u00e9m-publicada pode, portanto, existir por um curto per\u00edodo antes de ter uma an\u00e1lise completa de gravidade anexada, o que \u00e9 uma nuance que importa quando voc\u00ea est\u00e1 fazendo a triagem de algo totalmente novo.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c907b31 elementor-widget elementor-widget-heading\" data-id=\"c907b31\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">O Banco de Dados Nacional de Vulnerabilidades e o enriquecimento<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b3d3d92 elementor-widget elementor-widget-text-editor\" data-id=\"b3d3d92\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p class=\"FirstParagraph\"><span lang=\"EN-US\">O <b>Banco de Dados Nacional de Vulnerabilidades (NVD)<\/b>, administrado pelo NIST, \u00e9 baseado na lista CVE e \u00e9 onde a maioria dos profissionais de seguran\u00e7a realmente utiliza os dados do CVE. O NVD pega cada CVE publicado e adiciona an\u00e1lises, principalmente uma pontua\u00e7\u00e3o de gravidade do CVSS, refer\u00eancias e informa\u00e7\u00f5es sobre produtos, apresentadas em um formato estruturado que permite que os scanners comparem esses dados com seus ativos. Na pr\u00e1tica, quando um scanner de vulnerabilidades indica que um servidor est\u00e1 afetado por uma vulnerabilidade espec\u00edfica, ele est\u00e1 comparando seu software com registros CVE enriquecidos do NVD. Qualquer ac\u00famulo de trabalho ou atraso nesse enriquecimento pode deixar CVEs rec\u00e9m-publicados sem uma pontua\u00e7\u00e3o por um per\u00edodo, o que \u00e9 mais um motivo pelo qual equipes experientes n\u00e3o confiam em um \u00fanico sinal.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7946e58 elementor-widget elementor-widget-heading\" data-id=\"7946e58\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">CVE, CVSS, CWE, EPSS e KEV: como eles se encaixam<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9fc2583 elementor-widget elementor-widget-text-editor\" data-id=\"9fc2583\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p class=\"FirstParagraph\"><span lang=\"EN-US\">Esta fam\u00edlia de siglas \u00e9 a fonte mais comum de confus\u00e3o, and compreender como elas se relacionam \u00e9 o que separa um entendimento superficial da verdadeira flu\u00eancia. Cada uma responde a uma pergunta diferente:<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-29f5f40 elementor-widget elementor-widget-html\" data-id=\"29f5f40\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t\t<!DOCTYPE html>\r\n<html lang=\"en\">\r\n<head>\r\n<meta charset=\"UTF-8\">\r\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\r\n<title>Padr\u00f5es: pergunta e mantenedor (responsivo)<\/title>\r\n<style>\r\n \/* Paste from .ms-table-wrap down into your CMS. The .ms- prefix keeps it isolated from blog styles. *\/\r\n body { margin: 40px; background: #ffffff; }\r\n\r\n .ms-table-wrap {\r\n max-width: 860px;\r\n font-family: -apple-system, \"Segoe UI\", Roboto, \"Helvetica Neue\", Arial, sans-serif;\r\n color: #3f3f46;\r\n -webkit-font-smoothing: antialiased;\r\n }\r\n\r\n .ms-table {\r\n width: 100%;\r\n border-collapse: separate;\r\n border-spacing: 0;\r\n border: 1px solid #e5e7eb;\r\n border-radius: 10px;\r\n overflow: hidden;\r\n font-size: 15px;\r\n line-height: 1.5;\r\n }\r\n\r\n \/* Header: black bar, white bold text *\/\r\n .ms-table thead th {\r\n background: #1c1c1e;\r\n color: #ffffff;\r\n font-weight: 600;\r\n text-align: left;\r\n padding: 15px 22px;\r\n white-space: nowrap;\r\n }\r\n\r\n \/* Body cells *\/\r\n .ms-table tbody td,\r\n .ms-table tbody th {\r\n padding: 15px 22px;\r\n text-align: left;\r\n vertical-align: top;\r\n border-top: 1px solid #ececee;\r\n }\r\n\r\n \/* First column: teal, bold (row header) *\/\r\n .ms-table tbody th {\r\n font-weight: 700;\r\n color: #14808f;\r\n width: 140px;\r\n white-space: nowrap;\r\n }\r\n\r\n \/* Vertical dividers *\/\r\n .ms-table tbody td { border-left: 1px solid #ececee; }\r\n .ms-table thead th + th { border-left: 1px solid #33333a; }\r\n\r\n \/* Zebra striping *\/\r\n .ms-table tbody tr:nth-child(odd) th,\r\n .ms-table tbody tr:nth-child(odd) td { background: #f5f6f7; }\r\n .ms-table tbody tr:nth-child(even) th,\r\n .ms-table tbody tr:nth-child(even) td { background: #ffffff; }\r\n\r\n \/* ============================================================\r\n RESPONSIVE: on narrow screens the table reflows into cards,\r\n one card per row, so nothing gets cramped or cut off.\r\n ============================================================ *\/\r\n @media (max-width: 600px) {\r\n .ms-table { border: 0; border-radius: 0; }\r\n\r\n \/* Hide the header row visually, keep it for screen readers *\/\r\n .ms-table thead {\r\n position: absolute;\r\n width: 1px; height: 1px;\r\n padding: 0; margin: -1px;\r\n overflow: hidden; clip: rect(0 0 0 0);\r\n white-space: nowrap; border: 0;\r\n }\r\n\r\n \/* Each row becomes a self-contained card *\/\r\n .ms-table tbody tr {\r\n display: block;\r\n border: 1px solid #e5e7eb;\r\n border-radius: 10px;\r\n margin-bottom: 14px;\r\n overflow: hidden;\r\n }\r\n\r\n \/* All cells stack vertically, full width *\/\r\n .ms-table tbody th,\r\n .ms-table tbody td {\r\n display: block;\r\n width: auto;\r\n border-left: 0;\r\n border-top: 0;\r\n white-space: normal;\r\n padding: 12px 16px;\r\n }\r\n\r\n \/* First column becomes the card title *\/\r\n .ms-table tbody tr:nth-child(odd) th,\r\n .ms-table tbody tr:nth-child(even) th,\r\n .ms-table tbody th {\r\n background: #f5f6f7;\r\n color: #14808f;\r\n font-size: 17px;\r\n border-bottom: 1px solid #ececee;\r\n }\r\n\r\n \/* Body cells are white and show their column label above the value *\/\r\n .ms-table tbody tr:nth-child(odd) td,\r\n .ms-table tbody tr:nth-child(even) td,\r\n .ms-table tbody td {\r\n background: #ffffff;\r\n border-top: 1px solid #f1f1f2;\r\n }\r\n .ms-table tbody td:first-of-type { border-top: 0; }\r\n\r\n .ms-table tbody td::before {\r\n content: attr(data-label);\r\n display: block;\r\n font-size: 12px;\r\n font-weight: 700;\r\n text-transform: uppercase;\r\n letter-spacing: 0.04em;\r\n color: #8a8f98;\r\n margin-bottom: 3px;\r\n }\r\n }\r\n<\/style>\r\n<\/head>\r\n<body>\r\n\r\n<div class=\"ms-table-wrap\">\r\n <table class=\"ms-table\">\r\n <thead>\r\n <tr>\r\n <th scope=\"col\">Padr\u00e3o<\/th>\r\n <th scope=\"col\">Pergunta que responde<\/th>\r\n <th scope=\"col\">Mantido por<\/th>\r\n <\/tr>\r\n <\/thead>\r\n <tbody>\r\n <tr>\r\n <th scope=\"row\">CVE<\/th>\r\n <td data-label=\"Question it answers\">De qual vulnerabilidade espec\u00edfica se trata?<\/td>\r\n <td data-label=\"Maintained by\">MITRE \/ CNA<\/td>\r\n <\/tr>\r\n <tr>\r\n <th scope=\"row\">CWE<\/th>\r\n <td data-label=\"Question it answers\">Que tipo de fraqueza \u00e9?<\/td>\r\n <td data-label=\"Maintained by\">MITRE<\/td>\r\n <\/tr>\r\n <tr>\r\n <th scope=\"row\">CVSS<\/th>\r\n <td data-label=\"Question it answers\">Qu\u00e3o grave \u00e9, em tese?<\/td>\r\n <td data-label=\"Maintained by\">PRIMEIRO, pontuado no NVD<\/td>\r\n <\/tr>\r\n <tr>\r\n <th scope=\"row\">EPSS<\/th>\r\n <td data-label=\"Question it answers\">Qual \u00e9 a probabilidade de ser explorado em breve?<\/td>\r\n <td data-label=\"Maintained by\">PRIMEIRO<\/td>\r\n <\/tr>\r\n <tr>\r\n <th scope=\"row\">CISA KEV<\/th>\r\n <td data-label=\"Question it answers\">Est\u00e1 sendo ativamente explorado agora mesmo?<\/td>\r\n <td data-label=\"Maintained by\">CISA<\/td>\r\n <\/tr>\r\n <\/tbody>\r\n <\/table>\r\n<\/div>\r\n\r\n<\/body>\r\n<\/html>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-804cc92 elementor-widget elementor-widget-text-editor\" data-id=\"804cc92\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p>Uma CVE \u00e9 uma inst\u00e2ncia espec\u00edfica de um tipo de vulnerabilidade CWE, classificada quanto \u00e0 gravidade pelo CVSS, com uma probabilidade de explora\u00e7\u00e3o no mundo real pelo EPSS, e sinalizada pelo cat\u00e1logo KEV da CISA se os atacantes a estiverem explorando agora. Uma equipe que entende essa pilha prioriza muito melhor do que uma que reage apenas \u00e0s pontua\u00e7\u00f5es do CVSS.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-585a013 elementor-widget elementor-widget-heading\" data-id=\"585a013\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">O cat\u00e1logo KEV da CISA: priorizando o que importa<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-529afca elementor-widget elementor-widget-text-editor\" data-id=\"529afca\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p class=\"FirstParagraph\"><span lang=\"EN-US\">De todos os sinais acima, o cat\u00e1logo de Vulnerabilidades Conhecidas Exploradas da CISA merece aten\u00e7\u00e3o especial, porque ele responde \u00e0 pergunta que mais importa operacionalmente: quais das milhares de CVEs abertas os invasores est\u00e3o realmente explorando hoje. Uma vulnerabilidade estar no cat\u00e1logo KEV \u00e9 um forte sinal para corrigi-la urgentemente, independentemente de sua pontua\u00e7\u00e3o CVSS, porque isso tira a falha do campo te\u00f3rico e a coloca no de abuso ativo confirmado. Muitas organiza\u00e7\u00f5es agora estruturam suas prioridades de corre\u00e7\u00e3o focando primeiro no KEV, depois no EPSS e no CVSS, justamente porque isso direciona a capacidade limitada de remedia\u00e7\u00e3o para amea\u00e7as reais.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8f60d4b elementor-widget elementor-widget-heading\" data-id=\"8f60d4b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Como usar CVEs no gerenciamento de vulnerabilidades<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-170b843 elementor-widget elementor-widget-text-editor\" data-id=\"170b843\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p>Para uma equipe de seguran\u00e7a, as CVEs s\u00e3o o tecido conjuntivo de todo o programa de gerenciamento de vulnerabilidades. O fluxo de trabalho pr\u00e1tico se parece com isto:<\/p><ol><li><strong>Identificar<\/strong> quais CVEs afetam seu ambiente, cruzando um invent\u00e1rio de ativos preciso com a sa\u00edda de um scanner extra\u00edda da NVD.<\/li><li><strong>Priorizar<\/strong> usando m\u00faltiplos sinais em vez de apenas um. Comece com o cat\u00e1logo KEV da CISA para qualquer coisa sob explora\u00e7\u00e3o ativa, depois pondere a probabilidade do EPSS e a severidade do CVSS em rela\u00e7\u00e3o ao valor de neg\u00f3cio do ativo afetado.<\/li><li><strong>Remediar<\/strong> aplicando um patch, reconfigurando ou aplicando um controle compensat\u00f3rio, e ent\u00e3o confirme que a corre\u00e7\u00e3o funcionou.<\/li><li><strong>Faixa<\/strong> sua exposi\u00e7\u00e3o ao longo do tempo, medindo a rapidez com que voc\u00ea fecha as CVEs de maior risco, em vez de tentar fechar todas.<\/li><\/ol><p>A marca da maturidade n\u00e3o \u00e9 uma contagem de CVEs igual a zero, o que \u00e9 inalcan\u00e7\u00e1vel, mas sim um tempo comprovadamente curto para remediar as CVEs que representam risco real.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-aa1bd7f elementor-widget elementor-widget-heading\" data-id=\"aa1bd7f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Os limites do sistema CVE<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-43dd5a3 elementor-widget elementor-widget-text-editor\" data-id=\"43dd5a3\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p class=\"FirstParagraph\"><span lang=\"EN-US\">Uma compreens\u00e3o completa inclui o que o sistema CVE n\u00e3o cobre. Nem toda vulnerabilidade recebe um CVE. Falhas em software personalizado e interno, muitos problemas encontrados durante um teste de intrus\u00e3o privado e zero-days n\u00e3o divulgados podem n\u00e3o ter nenhum CVE, porque ningu\u00e9m solicitou ou publicou um. O sistema tamb\u00e9m depende de um enriquecimento oportuno, e per\u00edodos de atraso podem retardar a pontua\u00e7\u00e3o. Nada disso diminui o valor dos CVEs. Significa simplesmente que uma lista de CVEs \u00e9 um mapa de vulnerabilidades publicamente conhecidas, n\u00e3o um invent\u00e1rio completo do seu risco, e que testar seus pr\u00f3prios sistemas continua sendo essencial.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e3a581f elementor-widget elementor-widget-heading\" data-id=\"e3a581f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Conceitos errados comuns<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0015648 elementor-widget elementor-widget-text-editor\" data-id=\"0015648\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><strong>\u201cCVE e CVSS s\u00e3o a mesma coisa.\u201d<\/strong> Eles n\u00e3o s\u00e3o. Uma CVE \u00e9 a identidade de uma vulnerabilidade. O CVSS \u00e9 a sua pontua\u00e7\u00e3o de gravidade. Uma diz qual \u00e9 a falha, a outra diz qu\u00e3o grave ela \u00e9.<\/p><p><strong>\u201cSe tem uma pontua\u00e7\u00e3o CVSS baixa, eu posso ignor\u00e1-lo.\u201d<\/strong> N\u00e3o se estiver no cat\u00e1logo KEV do CISA. A explora\u00e7\u00e3o ativa supera uma pontua\u00e7\u00e3o de severidade modesta para fins de prioriza\u00e7\u00e3o.<\/p><p><strong>\u201cToda vulnerabilidade tem um CVE.\u201d<\/strong> N\u00e3o. Falhas em software personalizado, muitas descobertas de pentest e zero-days n\u00e3o divulgados frequentemente n\u00e3o t\u00eam CVE. Uma lista de CVEs n\u00e3o \u00e9 um retrato completo do seu risco.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1f01ca9 elementor-widget elementor-widget-heading\" data-id=\"1f01ca9\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Veja sua rede como um atacante faria \u2014 antes que ele o fa\u00e7a!<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f68b31a elementor-widget elementor-widget-text-editor\" data-id=\"f68b31a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p>A Mercurius realiza testes de Red Team com lideran\u00e7a manual, testes de penetra\u00e7\u00e3o e avalia\u00e7\u00f5es de nuvem que n\u00e3o apenas listam vulnerabilidades, mas provam o caminho exato que um advers\u00e1rio seguiria para chegar aos seus ativos mais valiosos e como fech\u00e1-lo.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-887a49d elementor-widget elementor-widget-html\" data-id=\"887a49d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t\t<!-- ===========================================================\r\n MERCURIUS \u2014 Attack Path Widget (standalone \/ Elementor-ready)\r\n Paste this whole block into an Elementor \"HTML\" widget.\r\n All CSS is scoped under .ms-apath-wrap to avoid theme conflicts.\r\n The trace animation runs on the published page (it may not\r\n preview inside the Elementor editor).\r\n =========================================================== -->\r\n<div class=\"ms-apath-wrap\">\r\n <div class=\"ms-apath-card\">\r\n <div class=\"ms-apath-head\">\r\n <span class=\"ms-apath-title\">Caminho de Ataque \u2192 Joias da Coroa<\/span>\r\n <span class=\"ms-apath-tag\">TIME VERMELHO<\/span>\r\n <\/div>\r\n\r\n <svg class=\"ms-apath-svg\" viewbox=\"0 0 540 320\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" role=\"img\"\r\n aria-label=\"Caminho de ataque ilustrativo: Reconhecimento Externo at\u00e9 Joias da Coroa\">\r\n <!-- connecting path -->\r\n <path class=\"ms-apath-line\" d=\"M64 44 C 116 44, 116 104, 158 104 S 210 166, 256 166 S 314 228, 346 228 S 402 290, 430 290\"\/>\r\n\r\n <!-- node 1 -->\r\n <g class=\"ms-apath-node ms-apath-n1\">\r\n <circle class=\"ms-apath-ring\" cx=\"64\" cy=\"44\" r=\"9.5\"\/>\r\n <circle class=\"ms-apath-core\" cx=\"64\" cy=\"44\" r=\"3.5\"\/>\r\n <text class=\"ms-apath-lbl\" x=\"86\" y=\"41\">Reconhecimento Externo<\/text>\r\n <text class=\"ms-apath-sub\" x=\"86\" y=\"55\">TA0043 \u00b7 Ativo exposto<\/text>\r\n <\/g>\r\n <!-- node 2 -->\r\n <g class=\"ms-apath-node ms-apath-n2\">\r\n <circle class=\"ms-apath-ring\" cx=\"158\" cy=\"104\" r=\"9.5\"\/>\r\n <circle class=\"ms-apath-core\" cx=\"158\" cy=\"104\" r=\"3.5\"\/>\r\n <text class=\"ms-apath-lbl\" x=\"180\" y=\"101\">Acesso Inicial<\/text>\r\n <text class=\"ms-apath-sub\" x=\"180\" y=\"115\">TA0001 \u00b7 Explora\u00e7\u00e3o da Web<\/text>\r\n <\/g>\r\n <!-- node 3 -->\r\n <g class=\"ms-apath-node ms-apath-n3\">\r\n <circle class=\"ms-apath-ring\" cx=\"256\" cy=\"166\" r=\"9.5\"\/>\r\n <circle class=\"ms-apath-core\" cx=\"256\" cy=\"166\" r=\"3.5\"\/>\r\n <text class=\"ms-apath-lbl\" x=\"278\" y=\"163\">Escalonamento Priv.<\/text>\r\n <text class=\"ms-apath-sub\" x=\"278\" y=\"177\">TA0004 \u00b7 configura\u00e7\u00e3o incorreta<\/text>\r\n <\/g>\r\n <!-- node 4 -->\r\n <g class=\"ms-apath-node ms-apath-n4\">\r\n <circle class=\"ms-apath-ring\" cx=\"346\" cy=\"228\" r=\"9.5\"\/>\r\n <circle class=\"ms-apath-core\" cx=\"346\" cy=\"228\" r=\"3.5\"\/>\r\n <text class=\"ms-apath-lbl\" x=\"368\" y=\"225\">Movimento lateral<\/text>\r\n <text class=\"ms-apath-sub\" x=\"368\" y=\"239\">TA0008 \u00b7 reutiliza\u00e7\u00e3o de cr\u00e9ditos<\/text>\r\n <\/g>\r\n <!-- node 5 (objective) -->\r\n <g class=\"ms-apath-node ms-apath-n5 ms-apath-final\">\r\n <circle class=\"ms-apath-pulse\" cx=\"430\" cy=\"290\" r=\"14\"\/>\r\n <circle class=\"ms-apath-ring\" cx=\"430\" cy=\"290\" r=\"11\"\/>\r\n <circle class=\"ms-apath-core ms-apath-core-obj\" cx=\"430\" cy=\"290\" r=\"4\"\/>\r\n <text class=\"ms-apath-lbl ms-apath-lbl-obj\" x=\"346\" y=\"294\">Joias da Coroa<\/text>\r\n <\/g>\r\n <\/svg>\r\n\r\n <div class=\"ms-apath-foot\">\r\n <span>5 passos \u00b7 0 alertas acionados<\/span>\r\n <span class=\"ms-apath-obj\">\u25cf objetivo alcan\u00e7ado<\/span>\r\n <\/div>\r\n <\/div>\r\n<\/div>\r\n\r\n<style>\r\n .ms-apath-wrap{\r\n --ms-ink:#161614; --ms-cyan:#5CDAF5; --ms-orange:#FF9A3A;\r\n --ms-line:rgba(255,255,255,.09); --ms-line2:rgba(255,255,255,.14);\r\n --ms-mono:'JetBrains Mono',ui-monospace,'SFMono-Regular',Menlo,Consolas,monospace;\r\n width:100%; max-width:540px; margin:0 auto; box-sizing:border-box;\r\n }\r\n .ms-apath-wrap *{box-sizing:border-box}\r\n .ms-apath-card{\r\n background:linear-gradient(165deg,#16161d,#101015);\r\n border:1px solid var(--ms-line2); border-radius:16px;\r\n padding:22px 22px 18px; box-shadow:0 30px 70px rgba(0,0,0,.5);\r\n }\r\n .ms-apath-head{display:flex;align-items:center;justify-content:space-between;margin-bottom:4px}\r\n .ms-apath-title{font-family:var(--ms-mono);font-size:12px;letter-spacing:.12em;text-transform:uppercase;color:#cfd2da}\r\n .ms-apath-tag{font-family:var(--ms-mono);font-size:11px;color:var(--ms-orange);\r\n border:1px solid rgba(255,154,58,.4);border-radius:5px;padding:3px 8px}\r\n .ms-apath-svg{width:100%;height:auto;display:block;overflow:visible}\r\n\r\n .ms-apath-lbl{font-family:var(--ms-mono);font-size:11px;fill:#d6d8e0}\r\n .ms-apath-sub{font-family:var(--ms-mono);font-size:9px;fill:#8a8e98;letter-spacing:.02em}\r\n .ms-apath-lbl-obj{fill:var(--ms-orange)}\r\n .ms-apath-ring{fill:#13131a;stroke:var(--ms-cyan);stroke-width:2}\r\n .ms-apath-core{fill:var(--ms-cyan)}\r\n .ms-apath-core-obj{fill:var(--ms-orange)}\r\n .ms-apath-final .ms-apath-ring{stroke:var(--ms-orange)}\r\n\r\n \/* static by default; animation classes added when in view *\/\r\n .ms-apath-line{fill:none;stroke:var(--ms-cyan);stroke-width:2;stroke-linecap:round}\r\n .ms-apath-node{transform-box:fill-box;transform-origin:center}\r\n\r\n .ms-apath-wrap.ms-go .ms-apath-line{\r\n stroke-dasharray:560;stroke-dashoffset:560;\r\n animation:ms-apath-trace 3.4s ease-in-out .2s forwards;\r\n }\r\n .ms-apath-wrap.ms-go .ms-apath-node{opacity:0;animation:ms-apath-pop .5s ease forwards}\r\n .ms-apath-wrap.ms-go .ms-apath-n1{animation-delay:.3s}\r\n .ms-apath-wrap.ms-go .ms-apath-n2{animation-delay:.95s}\r\n .ms-apath-wrap.ms-go .ms-apath-n3{animation-delay:1.6s}\r\n .ms-apath-wrap.ms-go .ms-apath-n4{animation-delay:2.25s}\r\n .ms-apath-wrap.ms-go .ms-apath-n5{animation-delay:2.9s}\r\n .ms-apath-wrap.ms-go .ms-apath-pulse{\r\n fill:none;stroke:var(--ms-orange);stroke-width:2;\r\n animation:ms-apath-ping 2s ease-out 3s infinite;\r\n }\r\n .ms-apath-pulse{fill:none;stroke:none}\r\n\r\n @keyframes ms-apath-trace{to{stroke-dashoffset:0}}\r\n @keyframes ms-apath-pop{from{opacity:0;transform:scale(.6)}to{opacity:1;transform:scale(1)}}\r\n @keyframes ms-apath-ping{0%{r:12;opacity:.7}100%{r:30;opacity:0}}\r\n\r\n .ms-apath-foot{display:flex;align-items:center;justify-content:space-between;\r\n margin-top:14px;padding-top:13px;border-top:1px solid var(--ms-line);\r\n font-family:var(--ms-mono);font-size:11px;color:#6f727a}\r\n .ms-apath-obj{color:var(--ms-orange)}\r\n\r\n @media (prefers-reduced-motion:reduce){\r\n .ms-apath-wrap.ms-go .ms-apath-line{animation:none;stroke-dashoffset:0}\r\n .ms-apath-wrap.ms-go .ms-apath-node{animation:none;opacity:1}\r\n .ms-apath-wrap.ms-go .ms-apath-pulse{animation:none}\r\n }\r\n<\/style>\r\n\r\n<script>\r\n(function(){\r\n var wrap = document.currentScript && document.currentScript.previousElementSibling\r\n ? document.querySelector('.ms-apath-wrap') : document.querySelector('.ms-apath-wrap');\r\n if(!wrap || wrap.dataset.msInit) return; \/\/ guard against double init\r\n wrap.dataset.msInit = '1';\r\n var fire = function(){ wrap.classList.add('ms-go'); };\r\n if('IntersectionObserver' in window){\r\n var io = new IntersectionObserver(function(es){\r\n es.forEach(function(e){ if(e.isIntersecting){ fire(); io.disconnect(); } });\r\n }, {threshold:.35});\r\n io.observe(wrap);\r\n } else {\r\n fire(); \/\/ fallback: just play\r\n }\r\n})();\r\n<\/script>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a614bb8 elementor-widget elementor-widget-heading\" data-id=\"a614bb8\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Saiba mais sobre o servi\u00e7o de pentest e seguran\u00e7a ofensiva da Mercurius<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-055dd3a elementor-button-info elementor-align-justify animated-fast elementor-invisible elementor-widget elementor-widget-button\" data-id=\"055dd3a\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{"_animation":"headShake"}\" data-widget_type=\"button.default\">\n\t\t\t\t\t\t\t\t\t\t<a class=\"elementor-button elementor-button-link elementor-size-sm\" href=\"https:\/\/mscyber.tech\/pt\/seguranca-ofensiva\/\">\n\t\t\t\t\t\t<span class=\"elementor-button-content-wrapper\">\n\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Saiba mais<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-bb7b591 elementor-widget elementor-widget-heading\" data-id=\"bb7b591\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Perguntas frequentes<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e34777d elementor-widget elementor-widget-text-editor\" data-id=\"e34777d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><strong>O que significa CVE?<\/strong> CVE significa \u201cCommon Vulnerabilities and Exposures\u201d (Vulnerabilidades e Exposi\u00e7\u00f5es Comuns). Trata-se de um sistema p\u00fablico de identificadores exclusivos para vulnerabilidades de seguran\u00e7a conhecidas, mantido pela MITRE e patrocinado pela ag\u00eancia norte-americana CISA.<\/p><p><strong>Qual \u00e9 a diferen\u00e7a entre CVE e CVSS?<\/strong> Um CVE \u00e9 o identificador exclusivo de uma vulnerabilidade espec\u00edfica, indicando de qual falha se trata. O CVSS \u00e9 o sistema de pontua\u00e7\u00e3o que classifica a gravidade dessa vulnerabilidade de 0,0 a 10,0, indicando o grau de gravidade dela. Normalmente, cada CVE possui uma pontua\u00e7\u00e3o CVSS associada a ele no NVD.<\/p><p><strong>Quem atribui os n\u00fameros CVE?<\/strong> Os identificadores CVE s\u00e3o atribu\u00eddos pelas Autoridades de Numera\u00e7\u00e3o CVE (CNAs), organiza\u00e7\u00f5es autorizadas pelo Programa CVE. Muitos fornecedores de tecnologia atuam como CNAs para seus pr\u00f3prios produtos, enquanto a MITRE opera e coordena o sistema como um todo.<\/p><p><strong>Todas as vulnerabilidades t\u00eam um CVE?<\/strong> N\u00e3o. Apenas vulnerabilidades publicamente conhecidas que foram relatadas e aceitas recebem um CVE. Falhas em software personalizado, muitos problemas encontrados em um teste de intrus\u00e3o privado e zero-days n\u00e3o divulgados podem n\u00e3o ter nenhum CVE.<\/p><p><strong>Como devo priorizar as vulnerabilidades (CVEs)?<\/strong> Comece pelo cat\u00e1logo de vulnerabilidades exploradas conhecidas da CISA, que identifica os CVEs sob ataque ativo; em seguida, avalie a probabilidade de explora\u00e7\u00e3o do EPSS e a gravidade do CVSS em rela\u00e7\u00e3o ao valor do ativo afetado. Priorizar com base na explora\u00e7\u00e3o ativa e no impacto nos neg\u00f3cios \u00e9 mais eficaz do que reagir apenas com base nas pontua\u00e7\u00f5es de gravidade.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"<p>Uma CVE \u00e9 o identificador p\u00fablico de uma vulnerabilidade conhecida. Saiba como o sistema funciona, o ciclo de vida da CVE, como a CVE difere do CVSS e do KEV, e como us\u00e1-los.<\/p>","protected":false},"author":5,"featured_media":3668,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18,22,23],"tags":[],"class_list":["post-3666","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-leadership","category-offensive-security","category-threat-intelligence"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>What Is a CVE? Common Vulnerabilities and Exposures - Mercurius Cybersecurity<\/title>\n<meta name=\"description\" content=\"A CVE is the public identifier for a known vulnerability. Learn how the system works, the CVE lifecycle, how CVE differs from CVSS and KEV, and how to use them.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/mscyber.tech\/pt\/o-que-e-um-cve\/\" \/>\n<meta property=\"og:locale\" content=\"pt_BR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What Is a CVE? Common Vulnerabilities and Exposures - Mercurius Cybersecurity\" \/>\n<meta property=\"og:description\" content=\"A CVE is the public identifier for a known vulnerability. Learn how the system works, the CVE lifecycle, how CVE differs from CVSS and KEV, and how to use them.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/mscyber.tech\/pt\/o-que-e-um-cve\/\" \/>\n<meta property=\"og:site_name\" content=\"Mercurius Cybersecurity\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-17T11:27:39+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-17T11:28:46+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/mscyber.tech\/wp-content\/uploads\/2026\/08\/Diagram-of-a-catalogued-security-flaw-assigned-a-CVE-identifier.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"600\" \/>\n\t<meta property=\"og:image:height\" content=\"450\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"kaue.simoes\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"kaue.simoes\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. tempo de leitura\" \/>\n\t<meta name=\"twitter:data2\" content=\"11 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/mscyber.tech\\\/what-is-a-cve\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/mscyber.tech\\\/what-is-a-cve\\\/\"},\"author\":{\"name\":\"kaue.simoes\",\"@id\":\"https:\\\/\\\/mscyber.tech\\\/#\\\/schema\\\/person\\\/2e057da44c0b9c841b3b8acba1459547\"},\"headline\":\"What Is a CVE? Common Vulnerabilities and Exposures\",\"datePublished\":\"2026-08-17T11:27:39+00:00\",\"dateModified\":\"2026-08-17T11:28:46+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/mscyber.tech\\\/what-is-a-cve\\\/\"},\"wordCount\":1557,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/mscyber.tech\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/mscyber.tech\\\/what-is-a-cve\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/mscyber.tech\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/Diagram-of-a-catalogued-security-flaw-assigned-a-CVE-identifier.jpg\",\"articleSection\":[\"Cyber Leadership\",\"Offensive Security\",\"Threat Intelligence\"],\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/mscyber.tech\\\/what-is-a-cve\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/mscyber.tech\\\/what-is-a-cve\\\/\",\"url\":\"https:\\\/\\\/mscyber.tech\\\/what-is-a-cve\\\/\",\"name\":\"What Is a CVE? Common Vulnerabilities and Exposures - Mercurius Cybersecurity\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/mscyber.tech\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/mscyber.tech\\\/what-is-a-cve\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/mscyber.tech\\\/what-is-a-cve\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/mscyber.tech\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/Diagram-of-a-catalogued-security-flaw-assigned-a-CVE-identifier.jpg\",\"datePublished\":\"2026-08-17T11:27:39+00:00\",\"dateModified\":\"2026-08-17T11:28:46+00:00\",\"description\":\"A CVE is the public identifier for a known vulnerability. Learn how the system works, the CVE lifecycle, how CVE differs from CVSS and KEV, and how to use them.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/mscyber.tech\\\/what-is-a-cve\\\/#breadcrumb\"},\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/mscyber.tech\\\/what-is-a-cve\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/mscyber.tech\\\/what-is-a-cve\\\/#primaryimage\",\"url\":\"https:\\\/\\\/mscyber.tech\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/Diagram-of-a-catalogued-security-flaw-assigned-a-CVE-identifier.jpg\",\"contentUrl\":\"https:\\\/\\\/mscyber.tech\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/Diagram-of-a-catalogued-security-flaw-assigned-a-CVE-identifier.jpg\",\"width\":600,\"height\":450},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/mscyber.tech\\\/what-is-a-cve\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/mscyber.tech\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"What Is a CVE? Common Vulnerabilities and Exposures\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/mscyber.tech\\\/#website\",\"url\":\"https:\\\/\\\/mscyber.tech\\\/\",\"name\":\"Mercurius Cybersecurity\",\"description\":\"AI-Driven Cyber resilience for critical organizations\",\"publisher\":{\"@id\":\"https:\\\/\\\/mscyber.tech\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/mscyber.tech\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pt-BR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/mscyber.tech\\\/#organization\",\"name\":\"Mercurius Cybersecurity\",\"url\":\"https:\\\/\\\/mscyber.tech\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/mscyber.tech\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/mscyber.tech\\\/wp-content\\\/uploads\\\/2025\\\/09\\\/MERCURIUS-LOGO-Light-Color-2.svg\",\"contentUrl\":\"https:\\\/\\\/mscyber.tech\\\/wp-content\\\/uploads\\\/2025\\\/09\\\/MERCURIUS-LOGO-Light-Color-2.svg\",\"width\":289,\"height\":48,\"caption\":\"Mercurius Cybersecurity\"},\"image\":{\"@id\":\"https:\\\/\\\/mscyber.tech\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/mscyber.tech\\\/#\\\/schema\\\/person\\\/2e057da44c0b9c841b3b8acba1459547\",\"name\":\"kaue.simoes\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/63c12ac971cb2964499a31feebfd9948fa35f6fa184fe2c25d8444b67112460a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/63c12ac971cb2964499a31feebfd9948fa35f6fa184fe2c25d8444b67112460a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/63c12ac971cb2964499a31feebfd9948fa35f6fa184fe2c25d8444b67112460a?s=96&d=mm&r=g\",\"caption\":\"kaue.simoes\"},\"url\":\"https:\\\/\\\/mscyber.tech\\\/pt\\\/author\\\/kaue-simoes\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"O que \u00e9 uma CVE? Common Vulnerabilities and Exposures - Mercurius Cybersecurity","description":"Uma CVE \u00e9 o identificador p\u00fablico de uma vulnerabilidade conhecida. Saiba como o sistema funciona, o ciclo de vida da CVE, como a CVE difere do CVSS e do KEV, e como us\u00e1-los.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/mscyber.tech\/pt\/o-que-e-um-cve\/","og_locale":"pt_BR","og_type":"article","og_title":"What Is a CVE? Common Vulnerabilities and Exposures - Mercurius Cybersecurity","og_description":"A CVE is the public identifier for a known vulnerability. Learn how the system works, the CVE lifecycle, how CVE differs from CVSS and KEV, and how to use them.","og_url":"https:\/\/mscyber.tech\/pt\/o-que-e-um-cve\/","og_site_name":"Mercurius Cybersecurity","article_published_time":"2026-08-17T11:27:39+00:00","article_modified_time":"2026-08-17T11:28:46+00:00","og_image":[{"width":600,"height":450,"url":"http:\/\/mscyber.tech\/wp-content\/uploads\/2026\/08\/Diagram-of-a-catalogued-security-flaw-assigned-a-CVE-identifier.jpg","type":"image\/jpeg"}],"author":"kaue.simoes","twitter_card":"summary_large_image","twitter_misc":{"Escrito por":"kaue.simoes","Est. tempo de leitura":"11 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/mscyber.tech\/what-is-a-cve\/#article","isPartOf":{"@id":"https:\/\/mscyber.tech\/what-is-a-cve\/"},"author":{"name":"kaue.simoes","@id":"https:\/\/mscyber.tech\/#\/schema\/person\/2e057da44c0b9c841b3b8acba1459547"},"headline":"What Is a CVE? Common Vulnerabilities and Exposures","datePublished":"2026-08-17T11:27:39+00:00","dateModified":"2026-08-17T11:28:46+00:00","mainEntityOfPage":{"@id":"https:\/\/mscyber.tech\/what-is-a-cve\/"},"wordCount":1557,"commentCount":0,"publisher":{"@id":"https:\/\/mscyber.tech\/#organization"},"image":{"@id":"https:\/\/mscyber.tech\/what-is-a-cve\/#primaryimage"},"thumbnailUrl":"https:\/\/mscyber.tech\/wp-content\/uploads\/2026\/08\/Diagram-of-a-catalogued-security-flaw-assigned-a-CVE-identifier.jpg","articleSection":["Cyber Leadership","Offensive Security","Threat Intelligence"],"inLanguage":"pt-BR","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/mscyber.tech\/what-is-a-cve\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/mscyber.tech\/what-is-a-cve\/","url":"https:\/\/mscyber.tech\/what-is-a-cve\/","name":"O que \u00e9 uma CVE? Common Vulnerabilities and Exposures - Mercurius Cybersecurity","isPartOf":{"@id":"https:\/\/mscyber.tech\/#website"},"primaryImageOfPage":{"@id":"https:\/\/mscyber.tech\/what-is-a-cve\/#primaryimage"},"image":{"@id":"https:\/\/mscyber.tech\/what-is-a-cve\/#primaryimage"},"thumbnailUrl":"https:\/\/mscyber.tech\/wp-content\/uploads\/2026\/08\/Diagram-of-a-catalogued-security-flaw-assigned-a-CVE-identifier.jpg","datePublished":"2026-08-17T11:27:39+00:00","dateModified":"2026-08-17T11:28:46+00:00","description":"Uma CVE \u00e9 o identificador p\u00fablico de uma vulnerabilidade conhecida. Saiba como o sistema funciona, o ciclo de vida da CVE, como a CVE difere do CVSS e do KEV, e como us\u00e1-los.","breadcrumb":{"@id":"https:\/\/mscyber.tech\/what-is-a-cve\/#breadcrumb"},"inLanguage":"pt-BR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/mscyber.tech\/what-is-a-cve\/"]}]},{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/mscyber.tech\/what-is-a-cve\/#primaryimage","url":"https:\/\/mscyber.tech\/wp-content\/uploads\/2026\/08\/Diagram-of-a-catalogued-security-flaw-assigned-a-CVE-identifier.jpg","contentUrl":"https:\/\/mscyber.tech\/wp-content\/uploads\/2026\/08\/Diagram-of-a-catalogued-security-flaw-assigned-a-CVE-identifier.jpg","width":600,"height":450},{"@type":"BreadcrumbList","@id":"https:\/\/mscyber.tech\/what-is-a-cve\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/mscyber.tech\/"},{"@type":"ListItem","position":2,"name":"What Is a CVE? Common Vulnerabilities and Exposures"}]},{"@type":"WebSite","@id":"https:\/\/mscyber.tech\/#website","url":"https:\/\/mscyber.tech\/","name":"Mercurius Cybersecurity","description":"Resili\u00eancia cibern\u00e9tica impulsionada por IA para organiza\u00e7\u00f5es cr\u00edticas","publisher":{"@id":"https:\/\/mscyber.tech\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/mscyber.tech\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pt-BR"},{"@type":"Organization","@id":"https:\/\/mscyber.tech\/#organization","name":"Mercurius Cybersecurity","url":"https:\/\/mscyber.tech\/","logo":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/mscyber.tech\/#\/schema\/logo\/image\/","url":"https:\/\/mscyber.tech\/wp-content\/uploads\/2025\/09\/MERCURIUS-LOGO-Light-Color-2.svg","contentUrl":"https:\/\/mscyber.tech\/wp-content\/uploads\/2025\/09\/MERCURIUS-LOGO-Light-Color-2.svg","width":289,"height":48,"caption":"Mercurius Cybersecurity"},"image":{"@id":"https:\/\/mscyber.tech\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/mscyber.tech\/#\/schema\/person\/2e057da44c0b9c841b3b8acba1459547","name":"kaue.simoes","image":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/secure.gravatar.com\/avatar\/63c12ac971cb2964499a31feebfd9948fa35f6fa184fe2c25d8444b67112460a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/63c12ac971cb2964499a31feebfd9948fa35f6fa184fe2c25d8444b67112460a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/63c12ac971cb2964499a31feebfd9948fa35f6fa184fe2c25d8444b67112460a?s=96&d=mm&r=g","caption":"kaue.simoes"},"url":"https:\/\/mscyber.tech\/pt\/author\/kaue-simoes\/"}]}},"_links":{"self":[{"href":"https:\/\/mscyber.tech\/pt\/wp-json\/wp\/v2\/posts\/3666","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mscyber.tech\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mscyber.tech\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mscyber.tech\/pt\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/mscyber.tech\/pt\/wp-json\/wp\/v2\/comments?post=3666"}],"version-history":[{"count":4,"href":"https:\/\/mscyber.tech\/pt\/wp-json\/wp\/v2\/posts\/3666\/revisions"}],"predecessor-version":[{"id":3671,"href":"https:\/\/mscyber.tech\/pt\/wp-json\/wp\/v2\/posts\/3666\/revisions\/3671"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mscyber.tech\/pt\/wp-json\/wp\/v2\/media\/3668"}],"wp:attachment":[{"href":"https:\/\/mscyber.tech\/pt\/wp-json\/wp\/v2\/media?parent=3666"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mscyber.tech\/pt\/wp-json\/wp\/v2\/categories?post=3666"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mscyber.tech\/pt\/wp-json\/wp\/v2\/tags?post=3666"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}