Read an NVD record in this order: vulnerability status, description, CVSS scores and who assigned them, weakness type (CWE), affected software configurations, references with their tags, and whether it is in CISA's Known Exploited Vulnerabilities catalog. Two minutes is enough to decide whether the record needs deeper reading.
We use CVE-2021-26855 (the ProxyLogon Exchange flaw) as the worked example, using the record as returned by the NVD API on 18 October 2026. NVD records change over time, so yours may differ.
1. What is the status?
Start with vulnStatus. Our example shows "Analyzed." NVD defines the statuses on its own page. Awaiting Analysis means the CVE is queued for enrichment. Undergoing Analysis means staff are adding reference tags, CVSS, CWE and CPE data. Deferred means NVD is not prioritizing enrichment due to resource or other concerns. Rejected means the CVE List invalidated the ID, and the record is hidden from default searches. The page also lists Received, Analyzed and Modified.
Why it matters: a record that is not yet analyzed may lack scores and affected-product data. Missing data is not the same as low risk.
2. What does the description say?
Read the plain English first. Ours: "Microsoft Exchange Server Remote Code Execution Vulnerability." Note the product, the effect and any precondition. Descriptions are written by the CVE numbering authority and are sometimes short, so treat it as a headline, not the full story.
3. Who scored it, and how?
The record lists several CVSS entries. Ours has two CVSS v3.1 scores from different sources: Microsoft rated it 9.1 (confidentiality and integrity high, availability none), and NVD's entry is 9.8 (all three high). Both are Critical. There is also an older CVSS v2 score of 7.5 High.
The lesson: always look at the source field. Scores can differ by who made them. Read the vector string, such as AV:N/AC:L/PR:N/UI:N, to see the logic: network attack vector, low complexity, no privileges, no user interaction. A score tells you severity in the abstract, not whether your environment is exposed.
4. What is the weakness?
The weaknesses field gives a CWE ID. Ours is CWE-918, server-side request forgery. A CWE helps you pick a fix pattern and spot related issues in your own code.
5. Which software is affected?
The configurations section lists affected products as CPE match criteria, with version ranges. Ours has 24 entries for Exchange Server cumulative updates. Check three things: does the vendor, product and version match what you run, are there "or earlier" ranges, and are some entries for other platforms? CPE matching can be imprecise for open source packages, so cross-check with the vendor advisory or a package ecosystem advisory.
6. What do the references say?
Each reference has tags. Ours includes "Patch" and "Vendor Advisory" for the Microsoft advisory, and "Exploit," "Third Party Advisory" and "VDB Entry" for several third-party pages. A Patch or Vendor Advisory tag means a fix or official guidance exists. An Exploit tag means someone published exploit information. Click vendor advisories first, and be careful with exploit links.
7. Is it known to be exploited?
NVD records can carry CISA KEV fields. Ours shows the vulnerability added to the catalog on 2021-11-03, with the required action "Apply updates per vendor instructions" and a due date of 2022-05-03 for federal agencies. CISA says organizations should use the catalog as an input to their prioritization. A KEV entry moves a CVE from "possible" to "seen in the wild."
What does a two-minute read produce?
A short note you can paste into a ticket:
- Status: Analyzed.
- Product and effect: Exchange Server remote code execution through SSRF.
- Severity: 9.8 (NVD) and 9.1 (Microsoft), both Critical.
- Weakness: CWE-918.
- Fix: vendor patch exists, link attached.
- Exploited: yes, in KEV since 2021-11-03.
What to do
- Read status first, then description, scores with their sources, CWE, configurations, reference tags and KEV.
- Never use a score without checking its source.
- Verify affected versions against the vendor advisory.
- Write a six line summary into the ticket.
- Rank by exploitation and exposure, not by CVSS alone.
Quick check
Does "Awaiting Analysis" mean the vulnerability is minor?
No. It means NVD has not yet added scoring and applicability data. Check the vendor advisory in the meantime.
Why can one CVE have two different CVSS scores?
Different sources score it. In our example Microsoft and NVD each published a CVSS v3.1 score, 9.1 and 9.8.
Sources
- NVD, Vulnerability status definitions
- NVD CVE API, record for CVE-2021-26855 (retrieved 18 October 2026)
- CISA, Known Exploited Vulnerabilities catalog
Last reviewed: 18 October 2026.
