Check eight things in order: the record state, who assigned it, the dates, the description, the affected versions and default status, the weakness type, the scores with their sources, and the references. That takes about five minutes and tells you whether to act, wait or close.
The eight fields
| Step | Field | Question to ask |
|---|---|---|
| 1 | State | Is it PUBLISHED or REJECTED? |
| 2 | Assigner | Who assigned it, and are they close to the product? |
| 3 | Dates | When was it reserved, published and last updated? |
| 4 | Description | What is the flaw, and what does an attacker need? |
| 5 | Affected | Which versions, and what is the default status for the rest? |
| 6 | Problem type | Which weakness class, such as a CWE entry? |
| 7 | Metrics | Which scores, from which sources? |
| 8 | References | Where are the vendor advisory, patch and write ups? |
Reading each step
State. The CVE record format says a rejected record stays on the list so users know it is invalid. If rejected, check for replacement IDs and stop there.
Assigner. Records show an assigner short name. A vendor assigning its own product's ID is usually well placed to state versions.
Dates. The reserved date does not show discovery or disclosure, per the schema. Use the published date for ageing, and your first seen date for your own clock.
Description. Look for the trigger: network or local, authentication needed, user action needed.
Affected. Read the ranges and the default status. An unknown default means unlisted versions are not cleared. See what defaultStatus unknown means.
Problem type. The weakness class hints at the fix pattern and at related issues to look for.
Metrics. Note source and vector, not only the number. CVSS measures severity, not risk, per the FIRST specification.
References. Open the vendor advisory first. It usually has the fixed version and workarounds.
What to decide at the end
- Does this apply to a component and version you run?
- Is it known to be exploited? Check the known exploited catalog.
- Can your code reach the affected part?
- Is a fixed version available?
- What is the owner and the date to act?
Write the five answers in the ticket. If you cannot answer one, write "unknown" and the date you will re-check.
Common slips
- Reading a score and skipping the vector.
- Treating the ID year as the disclosure year. See what the year in a CVE ID means.
- Closing a record as not affected without checking the default status.
- Ignoring the tags on the record, such as disputed. See CVE tags explained.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at the order in which a finding is checked before it is assigned.
Safeguard offers SBOM and dependency scanning and reachability analysis, which answer questions 1 and 3 above from your own code. Try a free scan.
Quick check
Which field matters most?
Affected versions, because they decide whether the record applies to you at all. Read the default status too.
Can I skip the references?
Not for a real decision. The vendor advisory usually has the fixed version and any workaround.
Sources
Last reviewed: 19 October 2026.
