How to Investigate a CVE — Evidence-Based Triage
A step-by-step method for investigating a CVE: verify the record, assess severity and CVSS, check exploit status and CISA KEV, identify affected products and fixes, then continue to evidence and investigation.
Quick Answer
To investigate a CVE, confirm the record and CVSS score on NVD, check whether it is in the CISA KEV catalog, identify affected products and fixed versions, then read advisories and verify exposure in your environment.
Definition
CVE investigation is the evidence-based process of triaging a vulnerability record to decide severity, exposure and remediation, using NVD, CISA KEV and vendor advisories as sources of truth.
Answer first
Investigate a CVE in five steps: verify → assess → check exploit → identify affected → plan fix.
1. Verify the record
Open the CVE in an authoritative source (NVD, MITRE CVE) and confirm the identifier, description and the fact that the entry is not RESERVED or REJECTED.
2. Assess severity with CVSS
Read the CVSS vector and base score. Understand what the vector means: attack vector, complexity, privileges, user interaction, and impact on confidentiality, integrity and availability.
3. Check exploit status
Look for public exploit proof-of-concepts, and check the CISA KEV catalog — if the CVE is known-exploited in the wild, treat it as higher priority regardless of score.
4. Identify affected software and fixes
List affected products and versions, and note the fixed version published by each vendor. Check product documentation for upgrade instructions.
5. Continue the intelligence loop
Follow the OpenTrojan record: view related entities, read the evidence, and start an investigation to track exposure and remediation in your environment.
Tools that help
- CVE Lookup — open the full OpenTrojan CVE record.
- IOC Lookup — check hashes, domains or IPs found in advisories.
- Investigation Workspace — track triage and fix progress.
References
Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.