CVE-to-ATT&CK mapping
Examine potential relationships between CVE records and ATT&CK techniques where supporting evidence or a documented mapping exists.
Vulnerability intelligence / Adversary behavior
Connect CVEs
to the ATT&CK
landscape.
Vulnerabilities tell part of the story. CVE Mapper helps security teams explore how CVEs relate to MITRE ATT&CK tactics and techniques, bringing vulnerability intelligence and adversary behavior into view.
ATT&CK relationship map / 001
● MAPPING VIEW
VULNERABILITY
CVE
ATT&CK
Technique
THREAT CONTEXT
Adversary behavior
ATT&CK
Tactic
VALIDATION
Evidence
TRACEABILITY
References
↗ CVE-to-ATT&CK context
⌘ Traceable mapping evidence
◎ Designed for security analysts
01 / The product
From CVE
to ATT&CK.
CVE Mapper is designed to connect vulnerability records with the MITRE ATT&CK knowledge base. Explore relevant tactics and techniques, understand why a relationship is proposed, and follow the evidence behind each mapping.
- Explore candidate CVE-to-technique relationships
- Navigate associated ATT&CK tactics and techniques
- Review mapping rationale and supporting references
- Distinguish confirmed evidence from inferred relationships
r. CVE Mapper
UI CONCEPT
Search CVE or ATT&CK technique...
⌘ K
VULNERABILITY RECORD01 / CVE
CVE-YYYY-NNNNN
Illustrative record. Actual CVE details and mapping relationships
must be populated from verified data sources.
Record typeCVE
ATT&CK domainTo be evaluated
Mapping statusUnverified
EvidenceReview required
ATT&CK RELATIONSHIPSEXPLORE
ATT&CK tacticTACTIC CONTEXT
↗
ATT&CK techniqueTECHNIQUE CANDIDATE
↗
Supporting sourceEVIDENCE REFERENCE
↗
Mapping confidence: not assessed
A mapping should only be considered verified after the available evidence and relationship criteria are reviewed.
resolvesec / CVE MAPPER
ILLUSTRATIVE DATA
02 / Capabilities
Put vulnerability data
into threat context.
Explore relationships with care. Understand the difference between a vulnerability, a technique that could exploit it, and evidence that a particular adversary behavior occurred.
Technique context
Explore technique descriptions, parent relationships, associated tactics, and relevant ATT&CK knowledge-base references.
Evidence and traceability
Keep mapping rationale and source references visible so analysts can evaluate the strength and limits of each relationship.
Context matters. A relationship is not proof of exploitation.
A CVE does not automatically imply a particular ATT&CK technique. CVE Mapper should distinguish sourced mappings, evidence-supported candidates, and unmapped records. Actual exploitation and observed adversary behavior require separate evidence.
03 / The workflow
Identify. Map.
Investigate.
A structured workflow for exploring the relationship between vulnerabilities and adversary techniques.
STEP / 01
Identify
Start with a CVE identifier and gather the available vulnerability description, affected products, and source references.
STEP / 02
Map
Evaluate possible ATT&CK technique relationships using documented mappings, technical evidence, and explicit mapping criteria.
STEP / 03
Investigate
Explore the relevant techniques, understand the mapping rationale, and follow references to validate the findings.
CVE Mapper / Get in touch
See the connection.
Understand the context.
Interested in connecting vulnerability intelligence with MITRE ATT&CK? Get in touch to discuss CVE Mapper and your security workflow.
04 / FAQ
Good questions.
Clear answers.
What to know about resolvesec and CVE Mapper.
CVE Mapper is resolvesec's planned vulnerability intelligence product
for exploring relationships between CVEs and MITRE ATT&CK tactics
and techniques. This page is a product concept, not a live mapping service.
MITRE ATT&CK is a knowledge base of observed adversary tactics and
techniques. It describes adversary behavior; it is not itself a
catalogue of vulnerabilities. Visit attack.mitre.org for the official resource.
No. A defensible mapping depends on the relationship criteria and
supporting evidence. Some CVEs may have documented relationships;
others may only support a candidate relationship or remain unmapped.
No. Its intended focus is vulnerability-to-ATT&CK relationship
analysis. Vulnerability discovery, asset inventory, and remediation
remain separate functions unless explicitly implemented.
This static page does not fetch CVEs or ATT&CK data. A production
implementation would need a data pipeline or API integration,
a documented mapping methodology, and validation of the results.