A CVE is a unique identifier, such as CVE-2026-12345, assigned to a publicly disclosed cybersecurity vulnerability, with a short description and references. To get one, contact the CVE Numbering Authority (CNA) whose scope covers the affected product. If none does, or it does not respond, request an ID from MITRE, the CNA of Last Resort.
Key takeaways
- CVE is a catalog of identifiers. The CVE Program's stated mission is to identify, define and catalog publicly disclosed vulnerabilities.
- Every CVE Record is added to the CVE List by a CNA, so you request an ID through one.
- The CNA rules follow a right of first refusal: the CNA with the most appropriate scope, often the product supplier, gets the first chance to assign.
- For publicly disclosed issues, if that CNA declines or stays silent for 72 hours, a Root must make a vulnerability determination and direct another CNA to assign.
- CVE does not score severity in general. Scores come from other parties such as NVD, or from the CNA if it chooses to add them.
What is a CVE?
A CVE ID is the number portion of a CVE Record, such as CVE-1999-0067. The archived CVE FAQ says CVE is not a vulnerability database. It links databases together, and each record carries an ID, a status, a brief description and references. Fix and scoring information come from other sources such as the US National Vulnerability Database.
Our other guides cover what a CVE is and CVE vs CWE in more depth.
What is a CNA?
A CNA is an organization authorized by the CVE Program to assign CVE IDs and publish CVE Records within a defined scope. The CNA Operational Rules (version 4.1.0) say a supplier CNA's scope is often defined by the products it owns or maintains, and that a research or coordination CNA's scope is often defined by the vulnerabilities it researches or coordinates.
The CNA of Last Resort (CNA-LR) covers what no other CNA does. MITRE operates one. The rules note that CNA-LRs typically have broader scopes and receive high volumes of requests.
How do you get a CVE ID?
Follow the escalation path. The CVE Program site tells reporters to contact the vendor's CNA first, then the CNA of Last Resort, then use the MITRE form as the final option.
- Find the CNA whose scope covers the product. If the vendor is a CNA, report to them through their stated contact method and disclosure policy.
- If the vendor is not a CNA, or does not respond, request an ID from the CNA of Last Resort. MITRE operates a CVE ID request web form and its CNA roles page lists it under "CVE ID Requests", open to suppliers and other vulnerability finders.
- Include what a CVE Record needs: the affected product and versions, the type of weakness, a description, and at least one public reference.
- Keep the confirmation. The archived request page says you receive a confirmation email with a reference number, and later communication continues by email.
Note that several of these pages are archived or lack timelines, so confirm the current steps on cve.org before you submit.
When will a CNA assign an ID?
When there is reasonable evidence of a vulnerability that has been or is expected to be publicly disclosed, and the issue is in the CNA's scope. CNA Rules 4.2.2.1 say a CNA should assign when all three conditions hold. Rule 4.2.5 says a CNA must not assign an ID for something it does not intend to disclose unless it is already or expected to be public.
CNAs should also disclose and assign if the issue could cause significant harm or needs action or risk assessment by parties other than the supplier.
What if the vendor will not respond?
Rule 4.2.1.2 sets a clock for publicly disclosed vulnerabilities. If the most appropriate CNA documents that it will not assign, says so within 72 hours, or does not respond within 72 hours, an appropriate Root must make a vulnerability determination. If the Root finds a vulnerability exists, it must direct a CNA-LR or another CNA with appropriate scope to assign as quickly as possible and within 72 hours of learning of the refusal.
For vulnerabilities that are not yet public, a refusal sends the requester to the dispute resolution process in the rules.
What goes in a CVE Record?
A record must identify at least one affected product, the type of weakness, a prose description and at least one public reference that is not the CVE Record itself. The rules say records should use Common Weakness Enumeration identifiers for the type, and should identify fixed versions where known. They also say descriptions must not credit people, organizations or tools, and must include an English description.
How much does a CVE cost, and how long does it take?
It is free. The archived FAQ says CVE is free to use and publicly available. It gives no timeframe for requests and says status updates arrive by email. The 72-hour clock above applies to the first-refusal process for disclosed issues, not to the whole request.
How to prepare a good request
- Confirm the issue is real and reproducible, and identify the exact affected versions.
- Check whether the vendor is a CNA, and use their disclosure policy first.
- Agree a disclosure date with the vendor if you are coordinating. See coordinated vulnerability disclosure.
- Prepare a description, weakness type, affected versions, fixed versions and one public reference.
- Do not request separate IDs for the same shared code across products. Rule 4.2.13 says a CNA must not assign more than one ID when products are vulnerable because they share the vulnerable code.
- Keep your confirmation email and reference number.
What do you do after the ID is assigned?
Publish the details and keep the record accurate. If you are a user rather than the reporter, the next step is to see whether a CVE affects your software. Safeguard's Gold registry lists packages and CVEs with CISA KEV status, and the free scan at gold.safeguard.sh/scan checks up to 100 dependencies in your browser, with no login and with your file kept on your machine.
Click through it at your own pace, or open it full screen.
Frequently asked questions
Can anyone request a CVE ID?
The archived request page says you may request a CVE ID for any vulnerability, and MITRE's roles page says the request form is open to suppliers and other vulnerability finders.
Is a CVE the same as a vulnerability?
No. A CVE is an identifier and record for a publicly disclosed vulnerability. The vulnerability is the flaw itself.
Do I need a CVE for every bug?
No. CNAs assign IDs for vulnerabilities with reasonable evidence that have been or will be publicly disclosed, and some issues are out of a given CNA's scope.
Who sets the CVSS score?
Generally not the CVE Program. The archived FAQ says severity scores for CVE Records are provided by NVD, and that some records include ratings only if the publishing CNA adds them.
Can a CVE be rejected?
Yes. CNA Rules 4.2.4 say that if a CNA assigns an ID, the vulnerability must be publicly disclosed or the CNA must reject the ID.
Sources
- CNA Operational Rules v4.1.0, cve.org, effective 14 May 2025
- CVE Program, Report and request a CVE ID
- CVE archived website, How to request CVE IDs, marked obsolete by cve.org
- CVE archived website, FAQs, marked obsolete by cve.org
- MITRE CVE roles and forms
Last reviewed: 19 October 2026.
