What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A CVE Numbering Authority (CNA) assigns a CVE identifier when it has reasonable evidence of a vulnerability, an appropriate approved scope, and a public-disclosure basis. The CNA with the most appropriate scope receives the first opportunity—often the product supplier, but not always. If that CNA refuses or stays silent about a publicly disclosed vulnerability, Root-level review can direct a CNA-LR or another suitable CNA to assign an identifier within the applicable 72-hour windows.
A CVE ID is a stable shared reference for a publicly disclosed vulnerability. It does not certify severity, prove that a fix exists, or guarantee that every reported issue receives an identifier.
As an Amazon Associate I earn from qualifying purchases.
What a CVE Numbering Authority does
A CVE Numbering Authority is an organization authorized by the CVE Program to assign CVE IDs and publish the corresponding CVE Records. CNAs operate only within the scope approved for them and must follow the CVE Program’s current policies and operational rules. The CVE Glossary defines the program’s terminology, while the CVE Program List of Partners shows participating organizations and their approved scope information.
CNAs can include product suppliers and their security teams, open-source projects and foundations, service providers, vulnerability researchers and coordinators, national computer security incident response teams, vulnerability databases, and bug-bounty providers. Authorization is about the organization’s approved scope, not its size or commercial status. A researcher CNA, for example, may have authority over vulnerabilities it researched or coordinated even when it is not the affected product’s supplier.
#1 Best Overall
The current controlling document is the CVE Program’s CNA Operational Rules, version 4.2.0. The CVE Board approved that version on August 20, 2026, and it became effective on August 25, 2026.
The assignment workflow from discovery to publication
The rules treat assignment as a scoped coordination process. A CNA first establishes that the issue is a vulnerability and then determines which authorized organization should handle the record.
- Establish the vulnerability and disclosure basis. The CNA needs reasonable evidence that a vulnerability exists. The issue must already have been publicly disclosed or be expected to become public. CNAs should disclose and assign vulnerabilities that could cause significant harm or require action or risk assessment by people beyond the CNA or supplier. An issue the CNA does not intend to disclose should not receive an ID unless it is already public or is expected to be publicly disclosed.
- Identify the approved scope. The CNA checks its documented scope and the scopes of other potentially responsible CNAs. Supplier scope commonly covers products the supplier owns, develops, or maintains. Research and coordination scope commonly follows vulnerabilities the CNA found or coordinated, subject to more specific coverage. A CNA must not assign outside its approved scope.
- Offer the first opportunity to the most appropriate CNA. The current rules state:
CVE ID assignment follows a ‘right of first refusal’ model.
The CNA whose scope most specifically covers the vulnerability is contacted first. That is frequently the supplier, but the rules do not make the supplier the automatic assignee in every case. - Escalate a refusal or silence when the issue is public. If the most appropriate CNA says in advance that it will not assign, responds within 72 hours that it will not assign, or fails to respond within 72 hours, an appropriate Root must decide whether a vulnerability exists. If the Root determines that one does, it directs a CNA-LR or another appropriately scoped CNA to assign as quickly as possible, no later than 72 hours after the Root becomes aware of the first refusal.
- Publish and maintain the record. An assigned ID must be accompanied by public disclosure from the CNA or another party. If the CNA cannot support public disclosure, it must reject the ID. Once published, the CVE ID is not changed merely to revise its year component.
How “most appropriate scope” is determined
Scope is the central answer to “Who assigns a CVE number?” The program does not simply give every report to the organization that first hears about it. It asks which CNA’s approved mandate most directly covers the vulnerability.
Recommended Free Tools
Supplier scope
A supplier CNA generally covers vulnerabilities in products that the supplier owns, develops, or maintains. This makes the supplier the usual first-refusal CNA for a flaw in its own code, but a supplier’s scope can be narrower than its entire product portfolio. The published partner listing is the authoritative place to check a CNA’s live scope.
Rank #2
Research and coordination scope
A research or coordination CNA may cover vulnerabilities it discovered, investigated, or coordinated, particularly where no more specific supplier scope applies. Its authority still depends on the written scope approved by the CVE Program; discovering an issue does not by itself authorize assignment for every affected product.
Root, CNA-LR, and other coverage
A Root is an organization that can resolve assignment disputes and coverage questions within its part of the CVE hierarchy. A CNA-LR exists to fill gaps for vulnerabilities inside its Root’s area when no other CNA covers them. The fallback is therefore a coverage mechanism, not a second route for bypassing a CNA that has the clearly most appropriate scope.
When a CNA should assign an identifier
Evidence and disclosure are separate from scope. A CNA can have the right scope but still lack a basis for assignment if the issue is unsubstantiated or will remain private.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Reasonable evidence: The CNA must have a factual basis for concluding that a vulnerability exists.
- Public or expected disclosure: Assignment is tied to a vulnerability that is already public or expected to become public. The rules discourage assigning IDs to private issues that the CNA does not plan to disclose.
- External impact: CNAs should publish and assign issues that may cause significant harm or require action or risk assessment by parties outside the CNA or supplier.
- Publicly available product: A vulnerability in a product that was never publicly available generally should not receive an ID.
- Not a training exercise: Educational or research vulnerabilities deliberately implemented for training are excluded.
- Technology category is not decisive: Calling a system cloud, artificial intelligence, embedded, or another category cannot by itself determine whether an ID is assigned. The vulnerability, disclosure basis, scope, and fixability analysis still control.
Can a vendor refuse to assign a CVE?
Yes. A supplier or other first-refusal CNA may state that it will not assign, either before the request is made or within the response window. Refusal does not automatically end the process when the vulnerability is publicly disclosed. The relevant Root must review whether a vulnerability exists and, if so, direct an appropriately scoped CNA to assign it.
Rank #3
| First-refusal response | What happens next | Rule timing |
|---|---|---|
| Preemptive statement that the CNA will not assign | Root determines whether a vulnerability exists; if it does, Root directs a CNA-LR or another suitable CNA. | Assignment no later than 72 hours after Root becomes aware of the first refusal. |
| Explicit refusal within the response period | Same Root determination and possible reassignment. | Assignment no later than 72 hours after Root becomes aware of the first refusal. |
| No response | After 72 hours, Root makes the vulnerability determination and can direct another CNA. | The first-refusal CNA’s response window is 72 hours; the directed assignment then has its own 72-hour ceiling from Root’s awareness of the refusal. |
| Agreement to assign | The accepting CNA proceeds within its scope and publishes the record with public disclosure. | No separate fallback deadline is triggered. |
These windows apply to the current public-vulnerability process in CNA Operational Rules version 4.2.0. They do not mean that every report receives an ID: the Root still has to determine that a vulnerability exists, and the eventual assignee must have appropriate scope and a disclosure basis.
How many CVE IDs should related issues receive?
The rules distinguish vulnerabilities from fixes. An identifier is assigned to the vulnerability whether or not a patch, update, or other remediation already exists. The key question is whether the issues are independently fixable.
| Technical relationship | Typical identifier treatment | Reason |
|---|---|---|
| Separate vulnerabilities that can be fixed independently | Generally one CVE ID per vulnerability. | Independent fixes represent distinct security problems. |
| Uncertain whether the issues can be fixed independently | Assign one ID. | The rules direct the CNA toward a single identifier when independent fixability is unclear. |
| Fully interdependent vulnerabilities | Do not assign different IDs. | Separating inseparable problems would misrepresent how they can be remediated. |
| Several products containing the same vulnerable code | One shared ID is generally appropriate. | The common vulnerable code is the unifying defect. |
| Products with different, non-shared vulnerable implementations | Separate IDs are recommended. | Different code paths may require independent fixes and analysis. |
When one product uses another product’s functionality or specification, the CNA also considers whether the implementation can be used securely. If secure use is possible, the record may need to distinguish a defective implementation from an unsafe dependency. Where no secure use is possible, the relationship can point toward a shared vulnerability description. The record should explain the technical relationship clearly enough that readers understand why the CNA chose one ID or several.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →The presence of multiple affected products therefore does not automatically produce multiple CVEs. Conversely, a single product release can contain more than one CVE when the defects are independently fixable.
Overlapping scopes and upstream dependencies
When two CNAs appear to cover the same issue
CNAs with overlapping scope are expected to coordinate, especially before public disclosure. If they cannot agree which CNA should assign, the dispute goes to the lowest-level organization they share: a Root, a TL-Root, or the Council of Roots, as applicable. Neither CNA may solve the dispute by assigning outside its own approved scope.
When the flaw is in an upstream dependency
If a Supplier CNA discovers a vulnerability in an upstream dependency, it must notify the upstream supplier and defer the first-refusal assignment opportunity when that upstream supplier is itself a CNA. The upstream CNA’s scope is more specific to the vulnerable component. The downstream supplier may still need to describe how its product is affected, but it should not claim the upstream scope merely because its product incorporates the dependency.
End-of-life products
A CNA’s approved scope may specify how it handles end-of-life products. If the supplier CNA does not cover the issue, another appropriately scoped CNA may be able to assign it. End-of-life status alone does not create a vulnerability and does not automatically justify a CVE ID; the ordinary evidence, disclosure, and scope tests still apply.
How the CVE year is chosen
The year in a CVE identifier is not necessarily the year in which a CNA first investigated the issue. Under the current rules, the year should be based on the calendar year in which the vulnerability was first publicly disclosed, the CVE Record was first published, or the ID was reserved. Those events can occur in different years, and assignment can occur in one year while publication occurs in the next.
| Event relevant to the year | What it means |
|---|---|
| First public disclosure | The vulnerability first becomes publicly known in that calendar year. |
| First publication of the CVE Record | The record is first made public in that calendar year. |
| Reservation of the ID | The CNA reserves the identifier in that calendar year before the record is published. |
Once an ID has been published, the CNA must not change it simply to alter the year component. A later discovery about timing is not a reason to renumber an established public reference.
What a CVE ID does—and does not—tell you
- It does provide: a common identifier and CVE Record that security teams, suppliers, researchers, vulnerability databases, and other parties can use to refer to the same publicly disclosed vulnerability.
- It does not provide: a severity score, a guarantee that exploitation occurred, proof that a patch is available, or a promise that every report will be accepted.
- It does not identify every affected product separately: shared vulnerable code can justify one record, while separate implementations can justify several.
- It does not override scope: only an authorized CNA acting within its approved mandate can make the assignment.
Severity assessment, affected-version analysis, exploitability, and remediation status may appear in a CVE Record or in related advisories, but those are distinct questions from who was authorized to assign the identifier.
A practical way to understand common assignment cases
| Case | Most likely first-refusal CNA | Likely outcome under the rules |
|---|---|---|
| A flaw in a supplier’s publicly available product, with no dependency issue | The supplier CNA, if its approved scope covers the product. | The supplier assigns or refuses; a public refusal or 72-hour silence can trigger Root review. |
| A vulnerability found and coordinated by a research CNA in an area not more specifically covered | The research or coordination CNA, subject to its approved scope. | It can assign if evidence and public disclosure requirements are met. |
| A downstream product is affected by a defect in an upstream library whose supplier is a CNA | The upstream supplier CNA. | The downstream Supplier CNA notifies and defers the first-refusal opportunity. |
| No other CNA covers a vulnerability inside a Root’s area | A CNA-LR designated for that Root’s coverage gap. | The CNA-LR can assign after the applicable determination and direction. |
| Two products contain different vulnerable implementations | The CNA whose scope covers each implementation. | Separate IDs are recommended when the vulnerabilities are independently fixable. |
What reporters should clarify when contacting a CNA
The rules do not turn a report into an automatic reservation. A report is easier to route when it makes the decision points explicit:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- What behavior demonstrates the vulnerability and what evidence supports it.
- Which product, component, versions, or implementations are affected.
- Whether the vulnerable code is shared across products or appears independently.
- Whether the issue can be fixed independently from other reported issues.
- Whether the affected product was publicly available and how public disclosure is expected to occur.
- Whether an upstream dependency or another CNA’s approved scope appears to be involved.
Those details help the receiving organization identify the most appropriate scope and choose one identifier or several. They do not guarantee assignment; the authorized CNA and, when necessary, the Root still apply the operational rules.
Historical pages versus the current process
The CVE Program has archived material, including an older Request CVE IDs page and an archived end-of-life assignment process. These pages can explain historical context, but they should not replace version 4.2.0 and the current partner list when determining who handles a live vulnerability. Current decisions should be read against the rules effective August 25, 2026.
Bottom line
Under the 2026 CVE rules, assignment is a scoped responsibility system. The CNA with the most appropriate approved scope gets the first refusal, commonly the supplier but sometimes a researcher, coordinator, upstream supplier, or another authorized organization. For a public vulnerability, refusal or 72-hour silence brings in Root review and can lead to assignment by a CNA-LR or another suitable CNA. Independent fixability, shared code, dependencies, disclosure status, and scope—not the number of products or the technology label alone—determine how the record is assigned and how many IDs are used.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
