Vulnerability Response vulnerability form fields

Vulnerabilities are created automatically when records are downloaded from the National Vulnerability Database (NVD), Common Weakness Enumeration (CWE), or third-party integrations and stored under Libraries in Vulnerability Response.

NVD entry fields

To view imported data in the fields listed in the following tables, you must have, at a minimum, the sn_vul.read_all role.

These fields are found on records listed in the National Vulnerability Database Entries [sn_vul_nvd_entry] table.

Field	Description
ID	Identifier for this vulnerability entry.
Risk rating	(Hidden when no VITs are associated with the vulnerability) Quantified Risk Score separating vulnerable items into Critical, High, Medium, Low, and None. For more information on risk ratings, see Vulnerability Response calculators and vulnerability calculator rules. Note: This base Risk rating is not the same as the Solution record Risk rating.
Risk score	(Hidden when no VITs are associated with the vulnerability) Calculated amount of risk the vulnerable item poses to your environment. Note: This base Risk score is not the same as the Solution record Risk score. For more information, see Vulnerability Response calculators and vulnerability calculator rules.
Severity	Normalized degree of severity of this vulnerability. Severity maps are provided for NVD and with ServiceNow third-party integrations. For more information on creating or adjusting severity maps, see Create a Vulnerability Response severity map.
Exploit exists	Yes, if at least one exploit is associated with this vulnerability.
Exploit skill level	Lowest skill level required to exploit this vulnerability.
Exploit attack vector	Most vulnerable attack vector of the exploits for this vulnerability. Available when SAM NVD is enabled.
Active VIs	(Hidden when no VITs are associated with the vulnerability) Number of vulnerable items associated with this vulnerability, not in the Closed state. If there are no active VIs for this vulnerability, Risk Rating and Risk Score are not displayed.
CWE entry	Reference to the Common Weakness Enumeration element that this vulnerability best fits into.
Date published	Date the vulnerability was published.
Last modified	Date the vulnerability was last modified.
Summary	Description of the vulnerability.
Threat intel (starting with Vulnerability Response version 20.0)	Threat intelligence provided by Qualys. With this data, you can understand a threat actor's motives, targets and attack behaviors.
Vulnerability Details
CVSS v2	Imported CVSS v2 data
CVSS v3	Imported CVSS v3 data, not available prior to 2015.
Preferred solution	(Hidden when no VITs are associated with the vulnerability) Solution of the highest-supersedence in the chain, derived from the solutions referenced in the vulnerability. If more than one highest-supersedence exists in the chain, no value is set. Any value set manually can be overwritten on subsequent imports. Setting this value manually should be done on the vulnerable item.
CISA Exploit (This tab is available only when the CISA application is installed.)
CISA due date	Deadline to resolve the vulnerability.
Date added	Date when the vulnerability was added to the CISA catalog.
Product	Product on which the vulnerability was identified.
Vendor/Project	Vendor associated with the identified vulnerability.
Known ransomwareStarting from v21.0 of Vulnerability Response.	Selected when the field Known To Be Used in Ransomware Campaigns is ingested from the CISA Known Exploited Vulnerabilities (KEVs) catalog. The flag is set at the Common Vulnerabilities and Exposures (CVE) level and rolled up to the third-party entry (TPE).
Remediation Status (Hidden when no VIs are associated with the vulnerability)
Excludes Deferred
Vulnerable items	Number of active vulnerable items with this vulnerability. This count excludes deferred vulnerable items.
Total VIs	Total number of vulnerable items with this vulnerability. This count excludes deferred vulnerable items.
%VIs remediated	Percent complete for remediation of vulnerable items with this vulnerability. This count excludes deferred vulnerable items.
Includes Deferred
Vulnerable items	Number of active vulnerable items with this vulnerability.
Total VIs	Total number of vulnerable items with this vulnerability.
%VIs remediated	Percent complete for remediation of vulnerable items with this vulnerability.
Related Links
Update status	Displays date and time of the last update. Updates the following: Remediation task state Risk score and rating Metrics such as Active VITs, Total VITs from the Remediation Status section
Related Lists
Vulnerable Items	(Hidden when no VITs are associated with the vulnerability) Vulnerable items associated with this vulnerability.
Vulnerability References	Information about the vulnerability from external sources, cited by NVD.
Exploits	Exploits associated with this vulnerability.
Solutions	(Hidden when no VITs are associated with the vulnerability) All Vulnerability Solution Management integration solutions associated with this vulnerability.
Weaknesses	Imported Weakness data associated to a Common Vulnerabilities and Exposures (CVE).
Vulnerable Software	(Hidden when software is associated with the CVE) Imported Common Platform Enumeration (CPE) data associated with the vulnerability.
Vulnerability Malware Kits	Malware imported from various scanner sources, for a vulnerability.

## CWE vulnerability entry fields

These fields are found on records listed in the CWEs [sn_vul_cwe] table.

Field	Description
CWE-ID	Identifier for this vulnerability entry. This identifier is used for both Categories and Weaknesses, and are unique between the two datasets.
Name	Descriptive name assigned to this CWE-ID.
Likelihood of exploit	How likely the weakness is to be exploited, on a qualitative scale. One of:- Unknown Low Medium High
OWASP Top 10 Position	This vulnerability's numerical position in the OWASP top 10 list.
SANS To 25 Position	This vulnerability's numerical position in the SAN top 25 list.
Class	Type of weakness
Status	One of:- Incomplete Draft Stable Deprecated Obsolete Unstable
Abstraction	One of:- Variant Class Base Compound
Updated	Last time the record was updated in the instance.
Functional areas	List of functional areas affected. For example, File Processing. Only populated for 24/862 weaknesses.
Affected Resources	List of affected resources. For example, File or Directory. Only populated for 51/863 weaknesses.
URL	Knowledge base article associated with this vulnerability.
Description	Description of the vulnerability.
Integration run	The integration run this CWE was imported in.
Sections
Additional details	Software concept descriptions that further explain the weakness. Includes:- Extended description Background details Notes
Detection methods	Details on how you might detect this weakness in an application.
Modes of introduction	The phases in which the weakness is introduced for example, Implementation, Architecture and Design, and so on.
Demonstrative examples	Code examples of the weakness with accompanying descriptions.
Potential mitigations	Details on how to prevent the weakness, including which phase of the application lifecycle it occurs in, and effectiveness of the mitigation.
Related Lists
Relationships	CWEs associated to this vulnerability. Lists relationships between this CWE and others. Can include parent/child, follows/precedes, requiredby/requires (for composite weaknesses), CanAlsoBe, PeerOf, MemberOf .
Observed Examples	Some CVEs that are representative of this weakness.
Common Consequences	Consequences of a successful exploit, in terms of scope and impact. For example: Scope: Confidentiality Impact: Read Application Data
Memberships	CWE memberships with this vulnerability.
Applicable Platforms	Platforms associated with this vulnerability.
Application Vulnerability Entries	Other application vulnerability entries associated with one.
External References	Information about the vulnerability from external sources.

## Third-party vulnerability entry fields

These fields are found on records listed in the Third-party Vulnerability Entries [sn_vul_third_party_entry] table.

Field	Description
ID	Identifier for this vulnerability entry.
Version 16.0: CVEs	Multiple Common Vulnerability and Exposures (CVEs) associated with this third-party vulnerability.
Source	Origin of the vulnerability — whether a scanner or physical test.
Risk rating	Quantified Risk Score separating vulnerable items into Critical, High, Medium, Low and None. For more information on risk ratings see, Vulnerability Response calculators and vulnerability calculator rules.Note: This base Risk rating is not the same as the Solution record Risk rating
Risk score	Calculated amount of risk the vulnerable item poses to your environment, based on risk score. Note: This base Risk score is not the same as the Solution record Risk score. For more information, see Vulnerability Response calculators and vulnerability calculator rules.
Severity	Normalized degree of severity of this vulnerability. Severity maps are provided for NVD and with ServiceNow third-party integrations. For more information on creating or adjusting severity maps, see Create a Vulnerability Response severity map.
Exploit exists	Yes, if at least one exploit is associated with this vulnerability.
Exploit skill level	Lowest skill level required to exploit this vulnerability.
Exploit attack vector	Most vulnerable attack vector of the exploits for this vulnerability.
Active VIs	Number of vulnerable items associated with this vulnerability, not in the Closed state.
Category	Classification provided by the third-party integration. Aids in assignment.
Remediation type	Types of remediation actions. - Patch Configuration change Patch and Configuration change Countermeasure
CWE entry	Reference to the Common Weakness Enumeration element that this vulnerability best fits into.
PCI	When the checkbox is selected, the vulnerability is flagged for significant risk for exposure of payment information.
PCI severity	Level of risk for exposure of payment information. [Qualys only.]
Date published	Date the vulnerability was published.
Last modified	Date the vulnerability was last modified.
Summary	Description of the vulnerability.
Vulnerability Details
CVSS v2	Imported CVSS v2 data
CVSS v3	Imported CVSS v3 data, not available prior to 2015.
Threat	Description of the threat from this vulnerability.
Preferred Solution	Solution of the highest-supersedence in the chain, derived from the solutions referenced in the vulnerability. If more than one highest-supersedence exists in the chain, no value is set. Any value set manually can be overwritten on subsequent imports. Setting this value manually should be done on the vulnerable item.
Remediation notes	Description of the remediation solution pulled from the vendor.
Remediation Status
Excludes Deferred
Vulnerable items	Number of active vulnerable items with this vulnerability. This count excludes deferred vulnerable items.
Total VIs	Total number of vulnerable items with this vulnerability. This count excludes deferred vulnerable items.
%VIs remediated	Percent complete for remediation of vulnerable items with this vulnerability. This count excludes deferred vulnerable items.
Includes Deferred
Vulnerable items	Number of active vulnerable items with this vulnerability.
Total VIs	Total number of vulnerable items with this vulnerability.
%VIs remediated	Percent complete for remediation of vulnerable items with this vulnerability.
Related Links
Update status	Displays date and time of the last update. Updates the following: Remediation task state Risk score and rating Metrics such as Active VIs, Total VIs from the Remediation Status section
Related Lists
Vulnerable Items	Vulnerable items associated with this vulnerability.
Vulnerability References	Information about the vulnerability from external sources, cited by NVD.
CVEs	Common Vulnerability Enumeration (CVE) record associated with this vulnerability.
Categories	Categories associated with this vulnerability.
Exploits	Exploits associated with this vulnerability.
Vulnerability Malware Kits	Malware kits associated with this vulnerability.
Solutions (Rapid7)	Solution information from the Rapid7 solution integrations. Displayed when available.
Exploit Frameworks	Exploit frameworks associated with this vulnerability.
Solutions	Vulnerability Solution Management solutions associated with this vulnerability.
CISA Exploit
CISA exists	CISA exploit exists for the Third-Party Vulnerabilities Entry table.
CISA due date	Deadline to resolve the vulnerability.

title	Vulnerability Response vulnerability form fields
description	Vulnerabilities are created automatically when records are downloaded from the National Vulnerability Database \(NVD\), Common Weakness Enumeration \(CWE\), or third-party integrations and stored under Libraries in Vulnerability Response.
locale	en-US
canonical_url	https://www.servicenow.com/docs/r/security-management/vulnerability-response/vulnerability-fields.html
release	brazil
product	Vulnerability Response
classification	vulnerability-response
topic_type	reference
last_updated	2026-09-10
reading_time_minutes	9
breadcrumb	Vulnerability Response reference informationVulnerability ResponseUnified Security Exposure ManagementSecurity Operations