Decode Civils CAShorts
Current affairs Open app
ExplainerSci-TechGS2GS3

Software vulnerabilities: CVE, CVSS, coordinated disclosure and CERT-In's role

By CAShorts DeskPublished Sources: CERT-In; India Code; PIB; PHP project; PHP Foundation; CVE Program; NIST NVD; FIRST; Wiz; Calif; Reuters; CyberScoop; SecurityWeek

Why in news: PHP fixed two critical remote-code-execution flaws on 21 October 2026; CERT-In's Vulnerability Note CIVN-2026-0510 the same day urged all PHP users to update.

Software vulnerabilities: CVE, CVSS, coordinated disclosure and CERT-In's role
Illustration (AI-generated)

A software vulnerability is a flaw an attacker can exploit. Publicly disclosed ones are named by Common Vulnerabilities and Exposures (CVE) IDs, rated 0-10 under the Common Vulnerability Scoring System (CVSS) and, ideally, fixed through coordinated disclosure. On 21 October 2026, CERT-In's Vulnerability Note CIVN-2026-0510 rated two newly fixed PHP flaws critical.

Syllabus: GS2 · Statutory & Regulatory Bodies; GS3 · IT, Space, Biotech & IPR; GS3 · Cyber Security & Money Laundering

Why this matters for UPSC

GS3 covers the basics of cyber security. Prelims can ask what CVE, CVSS and a zero-day are, and what Section 70B of the IT Act lets CERT-In do; Mains, how India should handle disclosed flaws and patching.

In short

A software vulnerability is an exploitable flaw. It is named by a CVE ID, scored by CVSS and fixed through coordinated disclosure; CERT-In anchors India's system.

From flaw to patchedserverFinder tellsvendorprivatelyCNA assignsCVE IDCVSS scoresseverityEmbargountil fixshipsUsers patchfast

The weak link is no longer naming or scoring flaws but the gap between a published fix and a patched server.

Why it matters

A school, clinic or small shop whose website runs on PHP through a shared hosting plan usually depends on the host to install a fix. Once a patch is public, attackers can study it, so a site left on an old version can be taken over, its data stolen or its pages defaced. Government services, banks and online stores run on the same language, so one flaw reaches across the web at once. For ordinary users, the stake is the passwords and records they hand to such sites. The larger issue is that much of the internet rests on shared code kept by small teams, and its safety depends on how fast fixes travel from them to every server.

Prelims pointers

  • CERT-In: a CVE Numbering Authority since October 2021 for vulnerabilities in products designed, developed and manufactured in India.
  • CVSS 4.0 (FIRST, November 2023): Base, Threat, Environmental and Supplemental metric groups; Supplemental never changes the score, and vendors and the NVD usually publish Base alone.
  • CVSS severity bands (FIRST): None 0.0; Low 0.1-3.9; Medium 4.0-6.9; High 7.0-8.9; Critical 9.0-10.0. FIRST says a score should be displayed with its vector string.
  • CVSS 4.0 has an Attack Requirements metric, absent from CVSS 3.1, and scores vulnerable-system and subsequent-system impacts separately in place of the old Scope metric.
  • National Vulnerability Database: the US government's vulnerability repository, run by NIST; it adds its own analysis, such as CVSS 3.1 scores, to CVE Records.
  • Section 70B(4), IT Act: CERT-In's functions include issuing guidelines, advisories, vulnerability notes and white papers; its notes are numbered CIVN, its advisories CIAD.
  • Section 70B(7): defying a CERT-In direction or call for information draws up to one year's jail, a fine up to one crore rupees (one lakh until 2023), or both.
  • CERT-In runs the National Cyber Coordination Centre (cyberspace scanning) and the Cyber Swachhta Kendra (botnet cleaning); the National Cyber Security Coordinator sits in the National Security Council Secretariat.

Practise a UPSC-style question

With reference to the Common Vulnerabilities and Exposures (CVE) Program, consider the following statements:

1. A CVE ID lets different parties refer with confidence to the same publicly disclosed vulnerability.

2. CVE IDs are assigned and their records published by the Forum of Incident Response and Security Teams (FIRST).

3. CERT-In is authorised as a CVE Numbering Authority for vulnerabilities in products of Indian vendors.

Which of the statements given above is/are correct?

  1. (a) 1 and 2 only
  2. (b) 2 and 3 only
  3. (c) 1 and 3 only
  4. (d) 1, 2 and 3
Show the answer

Answer: (c) 1 and 3 only

Answer: (c) 1 and 3 only. CVE IDs come from CVE Numbering Authorities, not from FIRST.

Statement 1: correct. A CVE ID is an alphanumeric string that identifies one publicly disclosed vulnerability, so vendors and defenders know they mean the same flaw.

Statement 2: incorrect. CVE IDs are assigned, and CVE Records published, by CVE Numbering Authorities (CNAs) that the CVE Program authorises; FIRST owns CVSS, the scoring system.

Statement 3: correct. CERT-In was authorised as a CNA in 2021 and assigns CVE IDs for flaws in products of Indian vendors and OEMs.

Eliminate: Statement 2 is the surest: FIRST owns CVSS, not the CVE list, so statement 2 is incorrect. Out: (a), (b), (d).

Trap: Swapped attribution. The body that owns the scoring system, FIRST, is put in place of the numbering authorities that assign CVE IDs; both work on vulnerabilities, so the swap reads true.

Remember: CVE names a flaw (CNAs, CERT-In for Indian products); CVSS scores it (FIRST).

More Explainers

All Explainers

More Sci-Tech current affairs