# CVE Record States: Published, Rejected and Disputed, and What Each Means for Vulnerability Triage

> A CVE ID is not always a confirmed, fixable flaw. The CVE Record Format has two states, Published and Rejected, plus tags such as disputed and unsupported-when-assigned. Here is what the rules say, what real records look like, and how to handle each in a triage queue.

- URL: https://firewallsync.com/posts/cve-record-states-published-rejected-and-disputed-what-each-means-for-vulnerability-triage/
- Site: FirewallSync (https://firewallsync.com/)
- Topic: Security Operations
- Tags: vulnerability management, fundamentals
- Published: 2026-10-16
- Author: FirewallSync Editorial

## Key takeaways

- The CVE Record Format defines two record states: PUBLISHED and REJECTED. A rejected record carries a required explanation (rejectedReasons) and an optional list of replacement IDs (replacedBy), so a scanner finding on a rejected CVE ID is stale data, not an open vulnerability.
- 'Disputed' is a tag on a published record, not a state. Under the CNA Operational Rules version 4.2.0 (effective August 25, 2026), a CVE Numbering Authority that marks a record disputed must use the tag and must include an explanation in the record. A disputed record is still published, and the tag only flags that someone disagrees.
- Two other CNA tags change what you should do: unsupported-when-assigned (the affected products were already end-of-life, so a fix may never come) and exclusively-hosted-service (only a vendor-run service is affected, so there may be nothing for you to patch).
- On October 16, 2026 the NVD API returned 408,789 CVE records, of which 390,296 were not rejected, which implies 18,493 (4.5%) were rejected in NVD's view. It listed 1,509 CVEs tagged disputed. Treat both as NVD counts on that day, not CVE Program statistics.
- Do not treat a disputed or end-of-life tag as 'low risk'. The EPSS exploitation-probability file for October 15, 2026 gave an unsupported-when-assigned WordPress plugin flaw (CVE-2020-35235) a score of 0.18284, at the 97th percentile.



A CVE ID (Common Vulnerabilities and Exposures identifier) looks like a settled fact: a number for one specific flaw. In practice the record behind it can be rejected, disputed, about a product nobody supports, or about a service you cannot patch. If your triage process treats every CVE ID in a scanner report the same way, it will waste effort on some and under-react to others. This guide explains the states and tags the CVE Program defines, shows real records, and suggests how to handle each case.

**Scope.** This is research-based analysis plus one script we ran. On October 16, 2026 we read the CVE Record Format schema (the CVEProject/cve-schema repository on GitHub, main branch), its tag definitions, and the CVE Program's CNA Operational Rules version 4.2.0 (approved August 20, 2026, effective August 25, 2026). We fetched records from the CVE Services API and queried the NVD (National Vulnerability Database) API. We did not read the CVE Program's policy for disputing a CVE record, which the rules reference. For how CISA adds triage fields in an ADP container, see [Vulnrichment SSVC values](/posts/cisa-vulnrichment-how-to-read-ssvc-values-in-a-cve-record-and-turn-them-into-a-patch-decision/).

## Who writes a CVE record

The schema's own description says the record format is the blueprint that CVE Numbering Authorities (CNAs) and Authorized Data Publishers (ADPs) use to describe a CVE record. A CNA is an organization authorized to assign CVE IDs within a defined scope. The schema says a record has at least one `cna` container, with exactly one allowed because only one CNA assigns the ID, and any number of `adp` containers added by other organizations. The CNA container must carry certain fields; an ADP container does not have to.

That split matters for triage. Everything you read in the `cna` container is the assigning organization's statement. Anything in an `adp` container, such as CISA's SSVC fields, was added by someone else.

## The two states: PUBLISHED and REJECTED

The schema defines a record as either "Published" (when a CNA populates the data for the ID) or "Rejected", and the `state` field in `cveMetadata` has only those two values. IDs that have been reserved but not yet published have no public record in this format that we could find; we did not test how the API presents them.

| State | What the record contains | Key fields |
|---|---|---|
| PUBLISHED | The CNA's description, affected products, references and more | `datePublished`, `descriptions`, `affected`, `references`, optional `tags` |
| REJECTED | No vulnerability details; an explanation instead | `dateRejected`, required `rejectedReasons`, optional `replacedBy` (an array of CVE IDs) |

Source: the schema's `cveMetadataPublished`, `cveMetadataRejected` and `cnaRejectedContainer` definitions.

### Why records get rejected

The CNA Operational Rules (version 4.2.0) say:

- CNAs **must** reject unused or unpublished CVE IDs (rule 4.5.3.5).
- CNAs **may** reject a published record. Common reasons include determining that no vulnerability exists, using an incorrect CVE ID, a duplicate assignment, or combining multiple IDs (4.5.3.6).
- A rejection must use the CVE Program's formats and must include an explanation (4.5.3.7).
- When IDs are merged, the redundant published IDs must be rejected (4.5.3.8).

### Two real rejected records

We fetched both from the CVE Services API on October 16, 2026.

| CVE ID | Assigner | Reserved | Rejected | Reason text in the record |
|---|---|---|---|---|
| CVE-2024-1992 | Wordfence | 2024-02-28 | 2024-03-20 | "Rejected as duplicate of CVE-2024-2306" |
| CVE-2019-1508 | Microsoft | 2018-11-26 | 2020-01-24 | "DO NOT USE THIS CANDIDATE NUMBER... This candidate was in a CNA pool that was not assigned to any issues during 2019." |

Neither record's `replacedBy` field was present, even though CVE-2024-1992's reason names a replacement in free text. If you automate "follow the replacement", parse the reason text as a fallback and do not assume the structured field is populated. We examined only these two records, so we cannot say how common that is.

## Tags: disputed, unsupported-when-assigned, exclusively-hosted-service

The schema defines tag lists. CNAs can use three tags, and ADPs only one.

| Tag | Who can set it | Schema definition (paraphrased) |
|---|---|---|
| `disputed` | CNA or ADP | One party disagrees with another party's assertion that an issue in software is a vulnerability |
| `unsupported-when-assigned` | CNA | When the CVE request was received, the product was already end-of-life or not supported by the vendor; only for records where all affected products or version lines are end-of-life |
| `exclusively-hosted-service` | CNA | All known affected software or hardware exists only in the affected hosted service; not used if on-premises products are also affected |

Sources: the schema's `cna-tags.json` and `adp-tags.json`, and CNA rules 4.2.17.1 (CNAs must use `unsupported-when-assigned` where all affected products no longer receive fixes), 4.5.3.10 and 5.1.11.

On disputes, the rules say CNAs and the Secretariat **must** use the `disputed` tag **and** provide an explanation in the record (4.5.3.10), and that CVE Program members **must** show the disputed status and the explanation when displaying CVE record data (4.5.3.11). The disputed tag marks a disagreement; it is not a verdict. The CNA rules point disputes to a separate CVE Program policy that we did not read.

### What these look like in real records

| CVE ID | State and tag | What the record says | Other checks on October 16, 2026 |
|---|---|---|---|
| CVE-2026-14683 | PUBLISHED, `disputed`, assigned by VulDB | A local memory-allocation issue in HdrHistogram up to 2.2.2. Text includes "It is still unclear if this vulnerability genuinely exists. This issue is disputed due to the potential lack of crossing of security boundaries and the pre-requisites for a successful attack." | Published 2026-07-04, updated 2026-07-16; has a CISA-ADP container; NVD lists it as disputed with vulnStatus "Deferred"; EPSS 0.0016 (percentile 0.04694) |
| CVE-2020-35235 | PUBLISHED, `unsupported-when-assigned`, assigned by mitre | elFinder access-control flaw in the secure-file-manager WordPress plugin through 2.5 that lets any authenticated user run the upload command to achieve remote code execution; description notes it affects only products no longer supported by the maintainer | Published 2020-12-14; EPSS 0.18284 (percentile 0.97186) |

The affected-products list of CVE-2020-35235 says vendor "n/a", product "n/a", version "n/a" with status "affected", so a scanner cannot match it by version from the CVE record alone.

Two points follow. First, the disputed record in our example questions whether the issue is a vulnerability at all. Its EPSS score is low, but a low score is a probability estimate, not proof that the dispute is right. Second, an end-of-life tag does not mean low risk: EPSS, which estimates the probability of observed exploitation activity in the next 30 days, put CVE-2020-35235 at the 97th percentile in the file scored 2026-10-15. See our [EPSS data feed guide](/posts/epss-data-feed-columns-percentile-vs-probability-and-how-to-join-it-to-a-scanner-export/) for how to read that column.

## The affected-status field: affected, unaffected, unknown

Inside a published record, each product version has a status of `affected`, `unaffected` or `unknown`. The schema says `unknown` means it is unknown or unspecified whether a version is affected, for reasons including that no investigation has been done or the vendor has not disclosed the status. The CNA rules require every record to identify at least one product as affected or unknown (5.1.4), say CNAs should resolve unknown status within a reasonable timeframe, and add that a permanent unknown may be appropriate, for instance when a product is suspected of being affected but has not been investigated (5.1.6). A record may not contain only unaffected products (5.1.8).

For triage: `unknown` is not a clean bill of health, and a version listed as `unaffected` is only as good as the CNA's analysis.

## How big are these categories?

We queried the NVD API on October 16, 2026. NVD is a separate database that ingests CVE records, so its numbers describe NVD's data, not the CVE List itself.

| Measure (NVD API, October 16, 2026) | Result |
|---|---|
| Total CVE records returned | 408,789 |
| Records returned with the `noRejected` parameter | 390,296 |
| Difference (implied rejected records) | 18,493 (4.5% of the total) |
| Records with `cveTag=disputed` | 1,509 |

We inferred the rejected count by subtraction; we confirmed that CVE-2019-1508 has vulnStatus "Rejected" without the parameter and returns no results with it, and that CVE-2024-1992 has vulnStatus "Rejected". The EPSS file we used elsewhere held 389,824 scored CVEs, close to the 390,296 non-rejected count but not identical. We did not investigate the 472-record gap, and the two files were queried hours apart.

## A triage playbook

These steps are our suggestions, not part of any CVE Program rule, and we did not test them in a production queue.

| What the scanner or feed shows | What to check | Suggested handling |
|---|---|---|
| CVE state is REJECTED | `rejectedReasons`, then `replacedBy` or the reason text | Close the finding as stale; if the reason names another CVE ID, make sure that ID is on your list |
| Published, tagged `disputed` | The explanation in the record, the vendor's advisory, your own exposure | Keep it in a "needs decision" state; record who decided and why. Do not auto-close and do not auto-escalate |
| Tagged `unsupported-when-assigned` | Whether you still run the product | If you do, the remedy is usually removal or replacement, since no vendor fix may exist. Check threat signals such as [KEV](/posts/cisa-kev-json-feed-what-each-field-means-and-how-to-match-it-against-a-scanner-export/) and EPSS before assuming it is low priority |
| Tagged `exclusively-hosted-service` | Whether you use the hosted service | There may be nothing for you to patch; ask the vendor for confirmation instead |
| Affected status `unknown` for your version | Vendor advisory | Treat as unresolved, not safe |
| In the CISA KEV catalog | The KEV entry and its notes | KEV is evidence of exploitation; see [CVSS vs EPSS vs KEV](/posts/cvss-vs-epss-vs-kev-which-signal-should-decide-what-you-patch-first/) |

## A tested script to read state and tags

This script fetches a record from the CVE Services API and prints the fields above. It uses only the Python standard library. The endpoint is a public API; we did not need a key for single-record lookups, but bulk queries returned a message that a `CVE-API-ORG` header is required.

```python
import json, sys, urllib.request

def triage_view(cve_id):
    url = f"https://cveawg.mitre.org/api/cve/{cve_id}"
    rec = json.load(urllib.request.urlopen(url, timeout=30))
    meta = rec["cveMetadata"]
    cna = rec["containers"]["cna"]
    out = {"cve": meta["cveId"], "state": meta["state"],
           "assigner": meta.get("assignerShortName"),
           "updated": meta.get("dateUpdated")}
    if meta["state"] == "REJECTED":
        out["rejectedReasons"] = [r["value"] for r in cna.get("rejectedReasons", [])]
        out["replacedBy"] = cna.get("replacedBy", [])
    else:
        out["cnaTags"] = cna.get("tags", [])
        out["adpTags"] = [t for a in rec["containers"].get("adp", [])
                          for t in a.get("tags", [])]
        out["statuses"] = sorted({v["status"] for p in cna.get("affected", [])
                                  for v in p.get("versions", [])})
    return out

if __name__ == "__main__":
    for cid in sys.argv[1:]:
        print(json.dumps(triage_view(cid)))
```

Run on October 16, 2026 against five IDs:

```
{"cve": "CVE-2024-1992", "state": "REJECTED", "assigner": "Wordfence", "updated": "2024-03-20T16:44:07.699Z", "rejectedReasons": ["Rejected as duplicate of CVE-2024-2306"], "replacedBy": []}
{"cve": "CVE-2019-1508", "state": "REJECTED", "assigner": "microsoft", "updated": "2020-01-24T21:14:20.000Z", "rejectedReasons": ["DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none"], "replacedBy": []}
{"cve": "CVE-2026-14683", "state": "PUBLISHED", "assigner": "VulDB", "updated": "2026-07-16T07:18:18.631Z", "cnaTags": ["disputed"], "adpTags": [], "statuses": ["affected"]}
{"cve": "CVE-2020-35235", "state": "PUBLISHED", "assigner": "mitre", "updated": "2024-08-04T17:02:07.522Z", "cnaTags": ["unsupported-when-assigned"], "adpTags": [], "statuses": ["affected"]}
{"cve": "CVE-2021-44228", "state": "PUBLISHED", "assigner": "apache", "updated": "2025-10-21T23:25:23.121Z", "cnaTags": [], "adpTags": [], "statuses": ["affected"]}
```

Known limits of the script: it assumes the record has a `cna` container and reads tags only from `tags`; it does not follow the version ranges inside `affected`; and it makes one request per ID, so do not run it over a whole scanner export without caching and rate limiting. A real pipeline should also handle HTTP errors, which we did not test.

## Limits of this article

We examined two rejected records, one disputed record and one end-of-life record out of hundreds of thousands, chosen for illustration, so they do not show how typical records look. Record contents and NVD counts change over time. We did not read the CVE Program's dispute policy and did not investigate NVD's own status labels such as "Deferred".

## Sources and verification

Checked on October 16, 2026.

| Important claim | Source | Verification |
|---|---|---|
| Records have one `cna` container and any number of `adp` containers; the two states are Published and Rejected; rejected records carry `rejectedReasons` and optional `replacedBy`; status values affected, unaffected, unknown | [CVE Record Format schema](https://github.com/CVEProject/cve-schema/blob/main/schema/CVE_Record_Format.json) | Verified |
| Tag definitions for disputed, unsupported-when-assigned and exclusively-hosted-service; ADPs may use only disputed | [CNA tags](https://github.com/CVEProject/cve-schema/blob/main/schema/tags/cna-tags.json), [ADP tags](https://github.com/CVEProject/cve-schema/blob/main/schema/tags/adp-tags.json) | Verified |
| Rules on rejecting, disputed tagging and display, EOL tagging, unknown status | [CNA Operational Rules v4.2.0](https://www.cve.org/Resources/Roles/Cnas/CNA_Rules_v4.2.0.pdf), effective August 25, 2026 | Verified |
| CVE-2024-1992 and CVE-2019-1508 are rejected, with the dates and reasons shown | [CVE Services API record](https://cveawg.mitre.org/api/cve/CVE-2024-1992), [second record](https://cveawg.mitre.org/api/cve/CVE-2019-1508) | Verified on October 16, 2026 |
| CVE-2026-14683 is tagged disputed with the quoted text; CVE-2020-35235 is tagged unsupported-when-assigned | [CVE-2026-14683](https://cveawg.mitre.org/api/cve/CVE-2026-14683), [CVE-2020-35235](https://cveawg.mitre.org/api/cve/CVE-2020-35235) | Verified on October 16, 2026 |
| NVD totals: 408,789 records, 390,296 with noRejected, 1,509 tagged disputed; vulnStatus of the examples | [NVD CVE API 2.0](https://services.nvd.nist.gov/rest/json/cves/2.0?cveTag=disputed&resultsPerPage=1) | Qualified: NVD counts on October 16, 2026; the rejected count is our subtraction |
| EPSS values for CVE-2020-35235 and CVE-2026-14683; 389,824 scored CVEs | [EPSS daily CSV](https://epss.empiricalsecurity.com/epss_scores-current.csv.gz), file scored 2026-10-15T12:03:56Z | Verified |
| EPSS definition: probability of observed exploitation activity in the next 30 days | [FIRST EPSS FAQ](https://www.first.org/epss/faq) | Verified |
| Script output | Run by us on October 16, 2026 against the five IDs shown | Verified |
| Triage playbook | Our analysis | Qualified: not tested in production |

## Frequently asked questions

### What does it mean when a CVE is rejected?

The CVE ID should no longer be used. The CVE Record Format's rejected record carries a required rejectedReasons field and an optional replacedBy list of CVE IDs. The CNA Operational Rules (version 4.2.0) say common reasons include determining that no vulnerability exists, using an incorrect CVE ID, a duplicate assignment, or merging several IDs. We found that the explanation text in real records varies, and replacedBy was empty in both rejected records we examined.

### Is a disputed CVE a false positive?

Not necessarily. The CVE schema describes the disputed tag as used when one party disagrees with another party's assertion that an issue in software is a vulnerability. The record stays published, and the CNA Operational Rules require the explanation to be shown with it. Read the explanation, then check the vendor's position before deciding.

### What is the difference between a CNA and an ADP container?

The CVE Record Format allows exactly one cna container, written by the CVE Numbering Authority that assigned the ID, and any number of adp containers, written by Authorized Data Publishers who add information. The CNA container is where the record's required content lives; an ADP container only needs provider metadata.

### Does a CVE with status 'unknown' for a version mean that version is safe?

No. The schema says 'unknown' means it is unknown or unspecified whether a version is affected, for reasons including that an investigation has not been done or that a vendor has not disclosed it. The CNA rules say CNAs should resolve unknown status within a reasonable timeframe, but a permanent unknown may be appropriate in some cases.


Image credit: Photo by [Maksym Kaharlytskyi](https://unsplash.com/photos/Q9y3LRuuxmg) on Unsplash