Yes. A CVE record can describe a product that is already end-of-life, and the CVE Record Format has a tag for it: unsupported-when-assigned. It tells readers the vendor no longer supports every product version line named in the record, so a patch should not be expected. Plan a replacement instead of waiting.
What the tag means
According to the CVE schema repository, the tag is used by the assigning CNA when the product was already end-of-life or unsupported by the vendor at the time a CVE was requested. It should be applied only when all referenced products or version lines are in that state.
That last condition matters. If one supported branch is affected, the record should not carry the tag, because a fix may exist for it.
How to read a record that has it
| You see | It suggests |
|---|---|
| The tag is present | No vendor fix is expected for any listed version line |
| The tag is absent, but the product is old | Check the vendor's support policy yourself |
| A fixed version is listed | At least one line was patched, so the tag likely would not apply |
Do not treat the tag as proof that an issue is exploited or not. It is a support statement, nothing more.
What you can do if you run the product
- Confirm the support status with the vendor or their published lifecycle page.
- Reduce exposure: remove it from the internet, restrict network paths, disable the affected feature.
- Look for a maintained fork or a vendor extended support option, and judge whether it is a real fix. Our guide on fixed versions and backported fixes covers that check.
- Set a replacement date and record it. Owning the risk with a date is better than leaving it open.
For acquisition work, unsupported components are also a diligence item, covered in end-of-life software in due diligence.
If you are the vendor
When a researcher reports a flaw in a product you retired, you still have choices: ship a final fix, publish a notice that the product is unsupported and affected, or both. Say which in plain words. Silence leaves customers guessing, and researchers will often publish anyway.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how a component is tracked over time, which is how you notice a dependency has stopped receiving fixes.
Quick check
Does the unsupported tag mean there is no exploit?
No. It only says the product was unsupported when the CVE was assigned. Exploitation status is a separate question.
When should the tag not be applied?
When any referenced version line is still supported, since a fix may be available for it.
Safeguard's asset discovery and dependency scanning can list which components in your estate are old, and a free scan is a quick start.
Sources
Last reviewed: 19 October 2026.
