Short answer
CVE stands for Common Vulnerabilities and Exposures. A CVE identifier gives a publicly disclosed vulnerability a shared reference, such as CVE-2026-109618. It is not a severity score, proof of exploitation or confirmation that your own system is affected.
Why the identifier matters
A single vulnerability may appear in an upstream advisory, a hosting-provider notice and an operating-system update. Matching the CVE helps confirm that everyone is discussing the same issue, even when package names and fixed versions differ.
The CVE Program describes its purpose as identifying, defining and cataloging publicly disclosed vulnerabilities. It is a coordination system, not a badge awarded only to catastrophic bugs.
CVE, severity and exploitation are different questions
- CVE: Which vulnerability are we discussing?
- Severity score: How serious can the technical impact be under the scoring assumptions?
- Applicability: Does our software and configuration meet the affected conditions?
- Exploitation evidence: Has an attacker been observed using it?
- Remediation: Which update or other action addresses it here?
Do not let a memorable vulnerability nickname replace the identifier. PHP2Shell covers two CVEs; the nickname alone is less precise when asking a host what it patched.
What to ask your provider
Is this CVE applicable to our installation? Which advisory and fixed package revision establish our status, and has the updated software been deployed to the services serving customers?
A vendor backport may mean the fix is present without the newest upstream version. Keep the advisory and deployment evidence together. “No alert on the dashboard” is not the same evidence.