The CVE record format lets a CNA attach three tags: disputed, unsupported-when-assigned and exclusively-hosted-service. Each one changes what the record means for you. On 19 October 2026 the NVD API counted 1,511 disputed, 1,284 unsupported-when-assigned and 420 exclusively-hosted-service records.
What each tag means
The definitions below follow the CVE Program's tag schema.
| Tag | Meaning | NVD count, 19 Oct 2026 |
|---|---|---|
| disputed | One party disagrees with another party's assertion that an issue is a vulnerability | 1,511 |
| unsupported-when-assigned | When the CVE request arrived, the product was already end of life or the version was not supported by the vendor. Used only when all affected versions are in that state | 1,284 |
| exclusively-hosted-service | All known affected software or hardware exists only in the affected hosted service. Not used if on premises software is also affected | 420 |
The counts come from the cveTag filter of the NVD CVE API and will drift as records change.
What to do with each
Disputed. Keep the record visible, read the dispute and decide if it applies. Our post on what disputed means goes deeper. Record the decision so it is not re-litigated at every scan.
Unsupported when assigned. The fix may never come, because the vendor no longer supports the product. If you run it, the real action is replacement or isolation, not waiting for a patch. See end of life software and scan results.
Exclusively hosted service. If the flaw lives only in a vendor's hosted service, there is usually nothing for you to patch, because the provider operates the fix. Your task is to check the provider's notice and see whether your data or accounts were affected. A scanner that finds no package to upgrade is behaving correctly.
How to filter in practice
- Pull the tag list from each record you triage.
- Route disputed items to a reviewer with context.
- Route unsupported items to an asset owner with a replacement question.
- Route hosted items to whoever manages the provider relationship.
- Do not auto close any of them just because of the tag.
To pull your own counts:
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?cveTag=disputed&resultsPerPage=1"
Read totalResults. Swap in the other tag names.
A caution about the totals
The three groups together are a small share of the NVD, and tags are only as good as the CNA that applied them. A missing tag does not mean a flaw is undisputed, only that nobody tagged it.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how different kinds of finding need different owners and actions.
Safeguard supports policies and gates around findings, so each category can have a rule you set. A free scan gives you the first list.
Quick check
Does a disputed tag mean the CVE is false?
No. It means one party contests the claim that the issue is a vulnerability. The record stays live.
Why does a hosted only CVE show no fix to apply?
The affected software exists only in the provider's service, so the provider applies the fix.
Sources
Last reviewed: 19 October 2026.
