---
title: SSVC enrichment for CVEs
description: Unified Security Exposure Management \(USEM\) enriches CVE entries with SSVC \(Stakeholder-Specific Vulnerability Categorization\) decision values from the National Vulnerability Database \(NVD\). These values provide additional risk signals that you can use to analyze and prioritize vulnerabilities. This enrichment is available only in USEM.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response/nvd-ssvc-enrichment.html
release: australia
product: Vulnerability Response
classification: vulnerability-response
topic_type: concept
last_updated: "2026-08-24"
reading_time_minutes: 3
breadcrumb: [National Vulnerability Database \(NVD\) integration, Vulnerability Response integrations, Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# SSVC enrichment for CVEs

Unified Security Exposure Management \(USEM\) enriches CVE entries with SSVC \(Stakeholder-Specific Vulnerability Categorization\) decision values from the National Vulnerability Database \(NVD\). These values provide additional risk signals that you can use to analyze and prioritize vulnerabilities. This enrichment is available only in USEM.

SSVC is a vulnerability prioritization framework developed by the CISA \(Cybersecurity and Infrastructure Security Agency\). It uses decision points based on factors such as exploitation, exploit automation, and technical impact to help organizations prioritize vulnerabilities.

[CISA's Binding Operational Directive \(BOD\) 26-04](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk), Prioritizing Security Updates Based on Risk, establishes a risk-based approach to vulnerability prioritization that considers these factors.

## SSVC fields

USEM provides the following SSVC decision values provided by NVD.

<table id="table_lsg_pmt_3kc"><thead><tr><th>

Field

</th><th>

Description

</th><th>

Values

</th></tr></thead><tbody><tr><td>

**Exploitation**

</td><td>

Indicates the exploitation status associated with the vulnerability.

</td><td>

-   None: No known exploitation.
-   Public PoC: A public proof of concept is available.
-   Active: Active exploitation is indicated.

</td></tr><tr><td>

**Automatable**

</td><td>

Indicates whether exploitation can be automated at scale.

</td><td>

-   No: Exploitation can't be reliably automated.
-   Yes: Exploitation can be reliably automated.

</td></tr><tr><td>

**Technical Impact**

</td><td>

Indicates the level of control an attacker can gain after successful exploitation.

</td><td>

-   Partial: Limited control or access.
-   Total: Complete control or compromise.

</td></tr></tbody>
</table>**Note:** The SSVC **Automatable** field is different from the existing **Automatable** supplemental metric in CVSS v4.0. Make sure you select the appropriate field when configuring filters, reports, or risk calculations.

## SSVC values and risk calculation

You can use SSVC fields in your vulnerability risk calculator to incorporate these values into risk scoring.

If your risk calculator uses one or more SSVC fields, a change to an SSVC value can trigger a recalculation of the risk score for the affected record.

For TPE records, changes to SSVC values rolled up from associated CVEs can also trigger a risk score recalculation when the TPE risk calculator uses one or more SSVC fields.

If your risk calculator does not use SSVC fields, the values remain available for viewing, filtering, sorting, and reporting but don't affect risk scores.

## SSVC roll-up to third-party entries

SSVC values roll up from CVE entries to the corresponding third-party entry \(TPE\) records. This roll-up happens automatically: it's triggered whenever NVD updates a CVE's SSVC values, and whenever a scanner integration links a CVE that already has SSVC values to a TPE.

When a TPE is associated with multiple CVEs, the SSVC values are aggregated using the following rules:

-   **Automatable**: If any associated CVE has a value of Yes, the TPE value is Yes.
-   **Technical Impact**: If any associated CVE has a value of Total, the TPE value is Total. Otherwise, the value is Partial.
-   **Exploitation**: The TPE value reflects the highest-priority value among the associated CVEs, in this order: Active, Public PoC, None.

If none of the associated CVEs have a value for a given field, the corresponding TPE field remains empty.

To populate SSVC values for CVEs that don't have them in your instance, set the **Import Since** field to an earlier date. Run the **NIST National Vulnerability Database Integration - API \(CVE only\)** integration. For more information, see [Perform a manual NVD integration import](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/manual-nvd-import.md). NVD returns data, including SSVC values, for CVEs modified on or after that date. The SSVC values then roll up automatically to linked TPE records.

**Note:** Starting with version 30.7 of the National Vulnerability Database Integration application, a scheduled process triggers within 15 minutes after installation to populate existing TPE records whose associated CVEs already have **Exploitation**, **Automatable**, and **Technical Impact** values. This process runs only once after installation.

## Where these fields appear

The **Exploitation**, **Automatable**, and **Technical Impact** fields are available on CVE entries and corresponding TPE records. You can:

-   Add the SSVC fields to **NVD** list views using the column selector.
-   View the fields on individual CVE records in the **Exploitability** section.
-   Add the SSVC fields to TPE list views using the column selector.
-   View the fields on individual TPE records in the **CISA Exploit** section.

## Data availability

SSVC values are available only for CVEs for which NVD provides SSVC data. If NVD does not provide an SSVC value for a CVE, the corresponding field remains empty.

SSVC values are sourced from NVD and can change when NVD updates its vulnerability data. The values displayed in USEM reflect the SSVC data available from NVD after the NVD integration processes the updated vulnerability information.