Request a CVE ID when customers or downstream users need to act on a fix and will want to track it across tools. Skip it for internal issues with no customer impact. The OWASP cheat sheet says to request CVE IDs where appropriate, and the call is yours.
What a CVE gives your customers
A CVE ID is a shared name. Scanners, advisories, ticket systems and auditors can all refer to the same problem. Without one, customers must read your prose and match it by hand. With one, their tools can flag the affected version automatically.
Who can assign one
CVE IDs are assigned through CVE Numbering Authorities. Some vendors are their own CNA. Others ask a coordinator. CISA's process, for example, includes a CVE determination stage where it decides whether the issue meets CVE Program rules and which CNA will publish the record, and CISA can act as the authoring CNA. Check the CVE Program's current rules and your options before you plan the timeline, since process details change.
When a CVE makes sense
- The flaw is in software customers install or run.
- A fix or workaround is available and customers must apply it.
- The issue is already public or likely to be.
- A researcher has asked for one and the issue is real.
When it may not
- The bug exists only in a hosted service you fully control and customers need do nothing.
- It is a hardening change with no exploit path.
- The issue was never shipped.
Even then, tell customers what they need to know, using an advisory.
Timing
Request the ID early so it appears in the advisory on release day. Agree with the researcher whether the ID is referenced in your communication before publication. Do not publish a record before the fix is available unless you have agreed to.
Be accurate in the record
Describe versions exactly. An imprecise record causes false alarms in customers' scanners or hides real exposure. Correct it quickly if you find an error. If you want to see how a vendor's CNA status shapes disclosure, read CNA status and why it matters.
Quick check
Does a CVE mean the bug is serious?
No. It identifies a vulnerability. Severity is a separate judgment.
Can a researcher request one without the vendor?
There are routes for that under CVE Program rules, which I could not re-verify for this post. Check the current CVE Program documentation.
Sources
Last reviewed: 19 October 2026.
