Confirm a CVE ID is needed, tell the affected vendor and allow five business days to acknowledge, then request from the vendor's CNA if one exists. If not, try a third party coordinator such as CERT/CC. Use the MITRE CVE request form last, and only if your product falls in its scope.
This order comes from the CVE program's archived researcher guidance. Some of that material is archived, so check cve.org for the current process before you rely on it.
The order
- Check whether you need an ID. CVE IDs are generally assigned only to vulnerabilities that will be publicly announced. Search the CVE List first, because an ID may already exist.
- Contact the vendor. Give them five business days to acknowledge. The guidance says auto-replies do not count.
- Ask the vendor's CNA, if the product belongs to one.
- Use a coordinator or list. If no vendor CNA can issue the ID, the guidance names third party coordinators such as CERT/CC, and lists oss-security and Bugtraq as options.
- Request from the MITRE CNA-LR, as a last resort, through the CVE Request web form.
For open source projects hosted on GitHub, the maintainers may be able to request an ID through a draft advisory instead: request a CVE through GitHub.
What goes in a MITRE request
Required:
- Type of request
- Your email address
- Number of IDs requested
- Vulnerability type for each ID
- Affected vendor for each issue
- Affected product and version, where a generic name is acceptable if the issue is not public yet
Optional extras include attack type, impact, affected component, attack vector, discoverer and references.
After you submit
Keep the confirmation email and reference number, and reply to it without changing the subject line when you follow up. Share the assigned ID with every affected party, and include it in the public announcement. After publication, use the web form to choose Notify CVE about a Publication and give the public links.
Some product areas may have their own routes, so check the current CVE site for yours.
Practical tips
- Say your disclosure deadline in the request if timing matters, and do not assume a fast turnaround.
- Do not publish before you have the ID if you want it in the first announcement.
- Keep records of your contact attempts. They help if a vendor goes silent.
For deadlines and what is normal, see disclosure deadlines explained.
Quick check
Is the MITRE form the normal first step?
No. The guidance puts it last, after the vendor, a vendor CNA and any coordinator.
Sources
Last reviewed: 19 October 2026.
