Fractality and Percolation Sensitivity in Software Vulnerability Networks: A Study of CWE–CVE–CPE Relations

Public CVE feeds add tens of thousands of entries each year, overwhelming patch-management capacity. We model the CWE–CVE–CPE triad and, for each CWE, build count-weighted product co-exposure graphs by projecting CVE–CPE links. Because native graphs are highly fragmented, we estimate graph-distance box-counting dimensions component-wise on the fragmented graphs using greedy box covering on unweighted shortest paths, then assess significance on the largest component of reconnected graphs. Significance is evaluated against degree-preserving nulls, reporting null percentiles, a z-score–based p-value, and complementary KS checks. We further characterise meso-scale organisation via normalized rich-club coefficients and k-core structure. Additionally, we quantify percolation sensitivity on the reconnected graphs by contrasting targeted removals with random failures for budgets of 1%, 5%, 10%, and 20%. This quantification involves tracking changes in largest-component size, average shortest-path length on the LCC, and global efficiency, and an amplification factor at 10%. Our corpus covers the MITRE CWE Top 25; we report high-level summaries for all 25 and perform the deepest null-model and sensitivity analyses on a subset of 12 CWEs selected on the basis of CVE volume. This links self-similar topology on native fragments with rich-club/core organisation and disruption sensitivity on reconnections, yielding actionable, vendor/software-type-aware mitigation cues. Structural indices are used descriptively to surface topological hotspots within CWE-conditioned product networks and are interpreted alongside, not in place of, EPSS/KEV/CVSS severity metrics.