**_We Raised $20 Million_** _/_ [_Read the Announcement_](https://raven.io/blog/%20raven-raises-20m-seed-round-to-protect-applications-at-runtime-even-without-signatures-or-cves)

.svg).svg)

Security

# What are CVE-Less Threats?

By

Roi Abitboul

For many years, security professionals have relied on the CVE system to identify vulnerable OSS libraries. This approach relies on  a database of known CVEs. Static scanners analyze codebases and flag CVEs for developers to address. However, the primary limitation of signature-based scanners is that they can only detect vulnerabilities that have already been documented and given a CVE ID. This traditional approach leaves a significant category of threats undetected: CVE-less threats, which surprisingly, are responsible for the majority of exploited vulnerabilities.

In this blog, we will explore the concept of CVE-less threats, examining why they are becoming increasingly prevalent and emerging as one of the most significant risks to cloud environments.

## CVE-Less is a Bigger Threat Than You Think

**Mandiant**: Analysis of Time-to-Exploit Trends 2023 (October 15, 2024)

70% of exploits in 2023 were CVE-Less, meaning they had no disclosed CVE at the time of the exploit. This marks an increase from 62% in 2022 and 61% in 2021.

## What are CVE-Less Threats?

Simply put, CVE-less threats refer to vulnerabilities that do not have a CVE-signature. CVE-less threats include:

### The Basics You Might Already Know:

- **`Unreported` Vulnerabilities**: Security flaws that are discovered but never reported to a central authority for inclusion in the CVE database. **‍**
- **Homegrown Libraries with Vulnerabilities**: Homegrown libraries might have unique vulnerabilities that will never be covered by a CVE entry.
- **Zero-Day Vulnerabilities:** Software flaws that are unknown to the vendor and have no available patch.

### Threats That Might Surprise You:

- **Reported But Not (yet) Published Vulnerabilities**: A CVE has to be discovered, reported to the NVD, assigned a CVE-ID, analyzed, and published before it can be detected by code scanning solutions. This leaves a window of exposure where the application is vulnerable to attacks.
  - Raven’s analysis of 28,660 CVEs published in 2023 reveals that it takes a CVE 103 days on average from assigned date to publish date.
  - Flashpoint’s 2024 Global Threat Intelligence Report states “One major blind spot occurs when enterprises strictly rely on the Common Vulnerabilities and Exposure (CVE) database, which is missing over 100,000 vulnerabilities—nearly a third of known vulnerability risk.” **‍**
- **Library Misconfigurations**: Issues that arise from improper library configurations in the code. These will never get a formal CVE signature. **‍**

## Conclusion

To combat sophisticated attackers and ensure the security of modern cloud applications, organizations must implement a security layer capable of detecting CVE-less attacks. Just as antivirus solutions evolved into endpoint detection and response (EDR) systems, there is a growing need for a solution that inspects applications at runtime, focusing on library-level activities to identify anomalies. This approach moves beyond reliance on CVE databases and instead monitors the behavior of libraries directly. This is where **Application Detection and Response (ADR)** comes into play.

For more information on advanced threat detection and mitigation, explore Raven’s [Runtime ADR](https://raven.io/runtime-adr). Book a demo today.