What is a CPE (Common Platform Enumeration)?

Common Platform Enumeration (CPE) is a structured way to name a product, platform, or operating system so that different tools refer to the same thing in the same way. It is the product-identification counterpart to the CVE's vulnerability identification.

Where a CVE names the flaw, a CPE names the affected product. Linking the two answers the practical question: does this vulnerability apply to the software I am actually running?

The current version is CPE 2.3, written as a colon-delimited formatted string. The general shape is cpe:2.3:part:vendor:product:version:update:edition:language:sw_edition:target_sw:target_hw:other.

The part field is a for applications, o for operating systems, and h for hardware. Fields that are not applicable use an asterisk for any or a hyphen for not-applicable.

A CVE record references CPE names in applicability statements that describe the set of affected products. These can include version ranges -- for example, all versions of a product before a fixed release -- so a single statement can cover many builds.

The NVD is a primary source of these CPE applicability statements, and CISA's Vulnrichment ADP also adds CPE data to records, which is what allows scanners to map a CVE to concrete installed software.

Without a common product vocabulary, matching vulnerabilities to assets would rely on fuzzy text matching of vendor and product names, which is error-prone. CPE gives that vocabulary a structured form.

In practice, CPE is what lets a vulnerability scanner say a specific CVE affects a specific host. It is the bridge between the abstract CVE record and your concrete inventory.