Does this CVE affect me? The five-minute path from identifier to answer

The CVE record for CVE-2024-3400 on cve.org gives the 10.2 branch a single range: anything from 10.2.0 up to but not including 10.2.9-h1 counts as affected. The vendor advisory for the same branch lists ten releases that fix it — the earliest is 10.2.0-h3. Run 10.2.7-h8 and you are patched according to the vendor and vulnerable according to the CVE record. That single gap is where most five-minute checks fall apart.

The question “does this affect me” is really two questions, and they need separate answers: is the product running here, in the affected release and configuration? And if so, how urgent is it? Both have fixed sources and a fixed order.

Five sources, and what each one is for

• Vendor advisory (PSIRT) — which exact release fixes it, and under which configuration.
• CVE record on cve.org — what the flaw is, who assigned it, a coarse version range.
• NVD — CVSS, CWE and a machine-readable product mapping, where the entry was enriched at all.
• CISA KEV and Vulnrichment — whether it is being used, whether it can be automated, how much control it gives.
• CERT-Bund advisories — the same situation in German, bundled per product, with a severity word instead of a number.

The order is not a matter of taste. Only the first source knows the release numbers; the second to fourth derive from it; the fifth translates it. Start at the top and you skip a round trip.

The path, in five steps

1. Look the identifier up at the vendor. Not in a database. Most vendors run a page per CVE — for the example above that is security.paloaltonetworks.com/CVE-2024-3400. That page carries the release numbers everything else copies.
2. Check the precondition, not just the version. CVE-2024-3400 only applies to firewalls with a GlobalProtect gateway or portal configured; the advisory even names the menu path to verify it (Network > GlobalProtect > Gateways or Portals). A matching version with the feature switched off is a “no”.
3. Query your own version, do not recall it. rpm -q openssl on RHEL or SUSE, dpkg-query -W -f='${Version}\n' openssl on Debian or Ubuntu, Get-HotFix in PowerShell for applied Windows hotfixes — though per Microsoft only those from Component Based Servicing, not those installed by Windows Installer. For appliances the exact build is on the dashboard — the one in your head is the one from before the last maintenance window.
4. Settle urgency with four questions. Publicly exposed, in the KEV catalogue, automatable, and how much control does it hand over. See the next section but one.
5. Write the answer down, with a date. Including the “not affected”. The next person to ask will be someone else, and an undocumented all-clear has to be earned twice.

The dead end: product name meets version number

Steps one to three sound mechanical and are not, because the mapping between “product X” and “the thing installed here” is only partly machine-readable. Of the 9,770 CVE records published in the NVD in July 2026 (excluding withdrawn ones), 4,884 — just under half — carry no CPE applicability statement at all: no structured statement of which product in which version range is affected. 3,598 of those 4,884 sit in the status Deferred, which the NVD defines as “not currently scheduled for NVD enrichment efforts”. Whether the statement ever arrives for them is an open question.

And where the mapping does exist, it is only as fine-grained as the record it came from. The PAN-OS example above shows what that costs: the vendor lists ten fix points across the 10.2 branch — 10.2.0-h3, 10.2.1-h2, 10.2.2-h5 and so on up to 10.2.9-h1 — while the CVE record collapses them into a single range starting at 10.2.0. Copy that range unchecked and you inherit the coarse version; the European EUVD does exactly that. The NVD, by contrast, enriched this entry and lists the hotfix levels one by one — 10.2.7-h8 is not among the affected there. That is the difference between an enriched and an unenriched entry, and only a part of them still get enriched. So: for version boundaries, the vendor advisory is the only authority. Databases are good at finding the case. They are bad at closing it.

Four questions instead of one number

On 10 June 2026 CISA revoked the directive that had governed the KEV catalogue since 2021 and replaced it with BOD 26-04. The interesting part is not the legal text — that binds US federal agencies, not you — but the decision table it publishes. The second of the four questions is answered by the KEV catalogue itself, which held 1,670 entries in its 18/08/2026 edition — flaws known to have been exploited. Urgency follows from four yes-or-no answers:

Three of the four answers are published, free, per CVE ID: CISA supplies exploitation status, automatability and technical impact through its Vulnrichment programme, and since 17 June 2026 the NVD carries the same values in its API. Only the first question — reachable from the internet or not — is yours to answer, and it is the one that moves the deadline the most. For CVE-2024-3400 the published values read: exploitation active, automatable yes, technical impact total. On a firewall answering from the internet that is the top row — and that row demands more than a patch. If a flaw is being used, can be automated and hands over full control, “we patched it” is half the answer. The other half is whether somebody got there first.

Why some entries carry no rating at all

On 15 April 2026 the NVD changed how it works. Submissions grew by 263 per cent between 2020 and 2025; the team enriched nearly 42,000 CVEs in 2025, 45 per cent more than in any earlier year, and still could not keep up. Since then only three groups are enriched with priority: entries in the KEV catalogue (target: within one business day), software used across the US federal government, and critical software under Executive Order 14028. Everything else stays in the database as “lowest priority”.

Two consequences follow directly for the five-minute check. First, the NVD no longer routinely adds a severity score of its own when the reporting authority already supplied one — the number you see is often the vendor’s. Second, some entries carry no number at all: 239 of those 9,770 July records had no CVSS value of any kind. A missing score is a missing analysis, not a small problem. That is exactly why the four questions above beat one number: three of them are answered even where nobody has scored anything.

The honest limitation

Five minutes assumes a vendor with a security team that publishes per CVE. For a small open-source library the advisory may be a commit message, and then it takes longer. Equally, an all-clear has a shelf life: the CVE-2024-3400 advisory was published on 12 April 2024 and kept being revised until 3 May 2024. Anyone who checked on day one and never looked again worked from a text that no longer existed in that form. And BOD 26-04 is not law for you — it is a decision table that happens to be public, tested and free. Adopting its deadlines is a choice, not an obligation.

The step before all of this

Every one of the five steps assumes you already know the answer to the question underneath them: does this thing even run here, and in which release. Nobody answers a CVE in five minutes without that. patchletter keeps that list — tick the products you look after in the catalogue and you get an email when a new version ships. The product page — the one for PAN-OS for instance — carries the latest release recorded, and where KEV entries are mapped to that product they sit next to it. The CVE page lists the flaws known to have been exploited that can be mapped to a tracked product. Free, no account, hosted in Germany.

Sources, retrieved 19/08/2026: CISA KEV catalogue, version 2026.08.18, 1,670 entries (JSON feed, cisa.gov). July 2026 figures from our own query of the NVD API on 19/08/2026 — 9,770 records published in July 2026 excluding withdrawn ones, of which 4,884 without a CPE applicability statement, 3,598 in status “Deferred”, 239 without any CVSS value. NVD announcements of 15/04/2026 and 17/06/2026. CISA BOD 26-04 of 10/06/2026, Table 1, plus the revocation notice on BOD 22-01. Version details and exposure conditions for CVE-2024-3400 from the Palo Alto Networks advisory and the CVE record at cve.org; the individually listed hotfix levels in the NVD for that identifier likewise from the NVD API. The caveat on Get-HotFixfollows Microsoft’s documentation of the WMI class Win32_QuickFixEngineering.