CVE IDs let vendors, researchers, scanners and advisories point at the same flaw. A zero-day often has no CVE until the vendor confirms it or ships a fix. A CVE number says a flaw exists; it does not say how severe it is or whether a patch is available.