Read a CVE record against your actual product and configuration
Use the identifier to find the vendor advisory, check affected versions and conditions and distinguish severity from proven exposure.
In brief
A CVE identifies a vulnerability; it does not by itself establish that your installation is affected. Read the product, version and configuration conditions, then use the vendor’s current fix instructions.
This turns a frightening number into a specific applicability and update decision.
Match the installation
Check exact product and version, including an optional module if mentioned. Zimbra CVE-2026-73570, for example, has a documented SNMP notification condition; the product name alone is not the full applicability test. Use the referenced advisory rather than guessing from a scan label.
Read scoring with context
Inspect the vector and source of a score, not just its colour. Network exposure, required access and user interaction can matter. Do not interpret “analysis pending” as no risk or invent a missing value to complete a report.
Close the actual action
Use current vendor guidance for a patch or supported mitigation and verify installation. If compromise is suspected, investigate separately; patching is not incident closure. Keep the applicability record dated and revisit it when the advisory or your configuration changes.
Before you act
NVD enrichment and scoring can change or be incomplete. A high score is not proof of active exploitation, and a low score does not establish that a critical business function is safe.
What to do next
- Open the exact CVE record and its vendor references.
- Compare the affected version and conditions with your installed configuration.
- Apply the supported fix or mitigation and record what you actually verified.
