What Is CVE Enrichment?

Q: Can I automate CVE enrichment for an AI agent?

Yes. vulntel exposes enrichment as an MCP tool (enrich_cve), so an agent gets a fused, cited record in one call, and can fact-check it with verify_cve_claim.

CVE enrichment is the process of taking a bare CVE identifier and attaching the context needed to act on it: severity, whether it is known-exploited, its exploitation probability, affected products and versions, available patches, and public exploit code. A raw CVE ID tells you almost nothing; an enriched CVE tells you whether to drop everything and patch, or to schedule it for next quarter.

What a CVE enrichment adds

KEV status : is it in CISA's Known Exploited Vulnerabilities catalog.
EPSS score : the probability of exploitation in the next 30 days, from FIRST.
SSVC decision : CISA's exploitation / automatable / technical-impact call.
Affected products and versions : from NVD and OSV/GHSA.
Public exploit / PoC signal : is working exploit code available.

Why enrich CVEs?

To prioritize. Tens of thousands of CVEs are published a year and only a small fraction are ever exploited: in our corpus of ~330,000 CVEs, only about 0.5% are in KEV. Enrichment is how you turn that flood into a ranked, act-on-able list instead of patching by CVSS and drowning in "criticals."

How vulntel enriches a CVE

enrich_cve fuses NVD, KEV, EPSS, OSV/GHSA and SSVC plus a live PoC signal into one exploitation-first record, and verify_cve_claim confirms the details (exists, affected version, severity, exploited) before your agent acts on them. That fact-check is what catches a hallucinated CVE before it reaches a report. It is exposed over MCP, so an AI agent enriches a finding in a single tool call.

FAQ

What does it mean to enrich a CVE? To attach decision context to the bare ID: severity, known-exploited status, exploitation probability, affected versions, patches, and exploit availability, so you can decide what to do rather than just look the CVE up.

What is the difference between CVE enrichment and a CVE lookup? A lookup returns the base record (description, CVSS). Enrichment joins in the signals that drive prioritization (KEV, EPSS, SSVC, PoC) so the output answers "should I act now," not just "what is this."

Which sources are used to enrich a CVE? NVD for the base record and CVSS, CISA KEV for known-exploited status, FIRST EPSS for exploitation probability, OSV/GHSA for ecosystem advisories, and CISA SSVC for the decision points, plus a public exploit signal.

Can I automate CVE enrichment for an AI agent? Yes. vulntel exposes enrichment as an MCP tool (enrich_cve), so an agent gets a fused, cited record in one call, and can fact-check it with verify_cve_claim.