Usually yes, if the flaw affects software that customers or other people run and you are shipping a fix. A CVE ID gives everyone one shared name for the issue. Request it through a CVE Numbering Authority whose scope covers your product, or through a CNA of Last Resort if none does.
What a CVE ID is
The CVE Program describes a CVE ID as the number portion of a CVE Record, written CVE-YYYY-NNNN. A CVE Record is the descriptive data about a vulnerability associated with that ID. The program says CVE is not a vulnerability database. It lets two people or tools refer to a vulnerability and know they mean the same issue.
CNAs are organizations authorized to assign IDs and publish records. According to the program, a CVE ID may be requested for any vulnerability, though the program prioritizes the vendors, products and product categories on its list of partners.
Who to ask
| Situation | Where to go |
|---|---|
| Your company is a CNA with scope covering the product | Assign the ID yourself under the CNA rules |
| Another CNA covers your product, such as a larger project or vendor | Ask that CNA |
| No CNA covers the product | Contact the CNA of Last Resort for the relevant root |
| A CNA rejected the request and you disagree | Appeal to the CNA of Last Resort |
The CVE FAQ says that CNA-LRs handle appeals and cases where no CNA has scope. Processing time varies by CNA, and delays can come from incomplete submissions or unverifiable references.
When a CVE ID helps
- Customers track the issue in scanners that key on CVE IDs.
- The affected software is distributed and users must upgrade.
- The researcher wants their finding cataloged.
- You are publishing an advisory anyway.
OWASP's guidance says a security advisory should include a CVE ID if one has been assigned, along with a summary of impact, affected versions, patched versions, any configuration caveats and workarounds.
When you might not
Some issues live only in a service you run, where customers have nothing to patch. Whether an ID makes sense depends on the CNA rules and your product scope, so check the current CNA rules for your case instead of guessing. If you are unsure, ask your CNA or the CNA-LR.
Practical steps
- Confirm the vulnerability and affected versions.
- Decide whether a fix or mitigation is available or planned.
- Identify your CNA route from the partner list.
- Submit with a clear description, versions, weakness type and a reference you will publish.
- Reserve the ID before the advisory goes out so the text and ID match.
- Update the record if the fix or scope changes.
What can go wrong
A reserved ID can sit in a RESERVED state until details are published. The program notes a record cannot be published with details until a public reference describes the vulnerability. A record can also be marked DISPUTED or REJECTED. If someone disagrees with a CVE assigned to your product, see what to do when you dispute a CVE.
Safeguard's role
Safeguard's SBOM and dependency scanning can show which of your releases contain an affected component, which helps you write the affected versions list. There is a free scan.
Quick check
Can a researcher request a CVE ID without my approval?
The CVE Program says any contributor can request an ID by following its steps, but a CNA decides. A coordinated process avoids duplicate or conflicting records, so agree on who requests it.
Does a CVE ID mean the bug is serious?
No. The ID is a name for the issue. Severity is a separate judgment.
Sources
Last reviewed: 19 October 2026.
