SECOND MEASUREMENT SM-018

A CVE numbering authority has 72 hours to publish the record once it has made the CVE ID public itself. ZDI, Dell, Drupal and Arista were past that on 1,107 of the 1,680 records we could score since January 2025, by a median of 13 days

Markovian ProtocolMeasured 2026-10-11Status: published 2026-10-11; questions sent to the four CNAs 2026-10-12; the Secretariat’s go through the Program’s formDOI: 10.5281/zenodo.23305970

Every CVE record names the organisation that assigned the ID, a CVE Numbering Authority, and most carry two dates: the day the CNA says the vulnerability became public and the day the record reached the CVE List. The CNA Operational Rules, in force since August 2024, say a CNA must publish the record within 72 hours of making a CVE ID public itself. We read both dates on every published record with a 2025 or 2026 ID in the CVE List’s own archive, 112,862 records, and scored the 16,340 with a usable public date. Among the 13,871 whose CNA points at its own site, 1,816 reached the list more than three days after the CNA’s own public date (13.1%), 340 more than a month after. Four CNAs we checked against their own advisory pages carry 1,107 of those: ZDI 526 of 682, Dell 350 of 719, Drupal 188 of 229, Arista 43 of 50. Microsoft was past it on 19 of 4,203. The rule’s remedy is that the CNA’s Root may have the CNA of Last Resort publish the record instead. In the Program’s glossary a Root is “an organization authorized within the CVE Program that is responsible, within a specific Scope, for the recruitment, training, and governance” of CNAs; the Secretariat is the organisation that runs the Program’s infrastructure and gives “administrative and logistical support” to its Board and working groups; a CNA of Last Resort, CNA-LR in the rules, is “a CNA authorized by a Root to assign CVE IDs and to publish corresponding CVE Records within that Root’s scope for vulnerabilities not covered by the Scope of another CNA” (glossaryEntries.json, the Glossary page’s data). For ZDI, Dell, Drupal and Arista the Root is MITRE, which is also their CNA of Last Resort and the Secretariat.

Disclosure: Markovian Protocol holds no financial position in any organisation named here, was paid by no one for this work, and showed it to no one before publication. How we work.

What the rule says, what we found

Quarter by quarter

Records whose CNA cites its own site, by the quarter the record reached the CVE List, newest first. The newest row covers 1 to 10 October 2026, the last day in the archive. “Late” is more than three whole days between the CNA’s public date and the list’s publication date. The newest quarters read low: a record that has not yet been published is not in the archive at all, so a CNA that has not run its batch shows no late records rather than many. Every row: cve72_by_quarter.csv.

Four CNAs, checked against their own pages

A record’s public date is the CNA’s own entry, so before trusting it we read the advisory each record cites and compared dates: 35 records each at ZDI, Arista and Dell and 30 at Drupal, all 2026 IDs; then ten 2025 IDs at each of the four, spread across the year. Of the 40 from 2025, 37 match within a day; two Dell records carry the date of a later revision of an older advisory, one the revision that says new CVEs were added and the other the revision two days after the one that says so, and one Arista record is dated a month after its advisory while its two siblings on the same page carry the advisory’s date. The scripts, every page read, the retrieval logs and the per-record results are in sm-018/secondpath/ (the 2025 set under 2025/).

Scored records are the CNA’s published 2025 and 2026 records with a public date, less those excluded by the reservation rule (Drupal 35, ZDI 11, Dell 1, Arista 0) and, for Drupal one and for Arista three, with no reference to the CNA’s own site. Each CNA’s Top-Level Root is MITRE, and MITRE is also the CNA of Last Resort the rule names (CNAsList.json, the Program’s partner roster, 11 October 2026).

Zero Day Initiative. Trend Micro’s bug-bounty program publishes an advisory page per finding with the date and the CVE ID on it. ZDI-25-950, a 7-Zip code-execution bug, is dated 7 October 2025; its record, CVE-2025-11002, reached the list on 23 January 2026, 108 days later, in a batch of 47 ZDI records that day. 526 of ZDI’s 682 records were late (77.1%); they went up on 42 distinct days, 101 of them on 21 July 2025. In the 35 sampled, 34 public dates equal the advisory’s date and one is a day later, ZDI-26-551, dated 11 August 2026 with a record public date of 12 August.

Dell. Dell’s security advisories carry a revision table with an initial-release date. DSA-2025-153, a client-BIOS password-recovery weakness, shows “1.0 · 2025-07-21 · Initial Release”; its record, CVE-2025-36579, was published on 16 April 2026, 269 days later. Dell was late on 350 of 719 (48.7%), on 144 distinct publish days, so its batches are smaller and more frequent than ZDI’s. Of the 35 sampled, 24 public dates equal the initial-release date exactly, 4 equal it once read in India time, 3 are two days after it in India time (one in UTC), and 3 are 2, 10 and 17 days after it; in all three of those the advisory page was changed on the record’s public date, two by a numbered revision and one by its last-modified date, and in one the ID was reserved after the initial release, so the ID may have been added at the change. The 35th, DSA-2026-360, carries a public date of 9 March 2026 for an advisory first released on 3 September; the ID was reserved in August, so the reservation rule drops it.

Drupal. Drupal’s security team publishes advisories as drupal.org nodes whose creation time is the record’s public date to the minute, for all 30 sampled. The Drupal security mailing list carries the same date for the three we matched there; the advisories’ RSS feed, which holds only recent items, agrees with node creation on eight recent advisories and on the two sampled ones it still listed; and of the 15 sampled advisories the Internet Archive has captured (11 of 30 queries failed and 4 found no capture), none was captured before its node was created. SA-CONTRIB-2026-031, an authentication bypass in a SAML module, went up on 1 April 2026 at 16:38 UTC; CVE-2026-5343 reached the list on 28 May, 57 days later. 188 of 229 were late (82.1%). Drupal’s own issue tracker has an issue for this, opened on 13 May 2026 in the security team’s issue queue and titled “Plan for how to meet 72 hour publication obligation (CNAv4.1 section 4.5.1.4)”; it lists thirteen records by advisory date, CVE-2026-5343 among them, with the days the published ones took.⁷

Arista. Arista’s advisories carry a date and a revision table. Security Advisory 0126, three CloudVision Exchange issues, is dated 18 November 2025; two of its records, CVE-2025-5088 and CVE-2025-5090, were published on 5 June 2026, 199 days later. Arista is the smallest of the four, 43 of 50 late (86.0%), and 35 of 35 sampled public dates equal the advisory date. The CNA reference on two sampled records pointed at URLs that now return an error; one advisory was read at the address NVD lists for it, the other at the same advisory under another address.

Every mapped CNA with thirty or more records

43 CNAs with at least 30 scored records that cite the CNA’s own site, most late first. One CNA with 30 or more scored records is outside the set: VulnCheck, left out on purpose (below). Every CNA, with and without own-site references: cve72_by_cna.csv; every scored record: cve72_rows.json.

Two CNAs need reading with care. VulnCheck is not in the table on purpose. It assigns IDs for vulnerabilities that other people disclosed, on GitHub and elsewhere; its public date is not the date of a VulnCheck advisory (the HestiaCP record CVE-2025-30008 gives 22 December 2025; the VulnCheck advisory it cites is dated 10 July 2026, the day the record was published; the fix pull request it cites was merged on 29 December 2025 and the fixed release came out on 28 May 2026; saved copies advisory, pull request, release), so its 347 late of 1,254 scored belong under the SHOULD of 4.5.1.6, not the MUST, and they sit in the all-records line only. Red Hat’s public date is the public date of its own security data (the podman record CVE-2025-11395 gives 7 November 2025 and Red Hat’s API gives the same day, saved copy), which for an upstream open-source project can be the upstream’s disclosure rather than Red Hat’s own, and every Red Hat record cites redhat.com, so the same may apply to part of its 181 of 1,096. Microsoft, Adobe and F5 publish the record within a day of their own advisory on 96 to 99% of theirs.

The longest waits

Fifteen longest gaps among records whose CNA cites its own site; the cut falls inside a tie of two Arista records at 199 days from one advisory, of which the first by ID is shown. Title as the CNA wrote it. The records as published, saved from the archive: sm-018/exhibits/records/.

How this ends

Two acts close it. The CNA publishes the record the day its advisory goes out, which for a batching CNA means running the batch on advisory day rather than on a calendar; the monthly reads see that as a late share near zero for each quarter once it is a month or more old, since the newest quarter cannot yet show the records that have not been published. Or the rule’s own remedy runs: the CNA’s Root, MITRE for all four named here, directs the CNA of Last Resort to publish the record, and the record’s provider changes. We re-pull the nightly archive on the first of each month, re-score every record, and print the result here, per quarter and per CNA.

The evidence

Every quote below was checked against a saved copy. Copies and SHA-256 hashes: SHA256SUMS.

"cveMetadata": { "cveId": "CVE-2025-11002", "assignerShortName": "zdi",
                 "dateReserved": "2025-09-25T18:50:55.181Z",
                 "datePublished": "2026-01-23T02:47:05.205Z", "state": "PUBLISHED" }
"containers": { "cna": { "datePublic": "2025-10-07T21:26:07.793Z",
                 "references": [ { "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-950/" } ] } }

Our questions

For the four CNAs named above and for the CVE Program’s Secretariat. Answers will be printed here as written.

1. To ZDI, Dell, Drupal and Arista: is the date on your advisory the day the CVE ID became public, and is the record’s datePublic meant to be that day? What sets the interval between an advisory and its record reaching the list?
2. To the Secretariat: since 4.5.1.4 took effect on 8 August 2024, has any Root directed a CNA of Last Resort to publish a record under it? Does the Program measure the interval, and if so from which field?
3. To the Secretariat: 8,058 records carry a public date after their publication date, 7,981 of them from Patchstack. Is a record published before the date it gives for disclosure inside the format’s intent?

Their reply, scored

What we told whom, and when.

What we can’t be sure of

• datePublic is optional and 28,965 of 112,862 records carry it. A CNA that leaves it blank is invisible here, late or not; the table ranks only CNAs that state a public date, and a CNA that stops stating one would drop out of it.
• The field is the CNA’s own entry. Four CNAs were checked against their pages; the other 230 were not, and the comparison is only as good as the CNA’s habit of filling the field with the advisory date. Patchstack’s public date is later than its publication date on 7,981 records, so its records go up before the day it gives for disclosure, and they are dropped rather than counted as early. VulnCheck’s public date precedes the ID’s reservation on 3,983 records, which is what assigning IDs to old, already-public bugs looks like; those are dropped too.
• Own-site citation is a proxy for “the CNA made the ID public itself”, and the rule’s MUST turns on that. The domains come from the Program’s roster and a hand list, 219 of the 234 scored CNAs; a CNA with no domain listed is never counted as its own discloser. For ZDI, Dell, Drupal and Arista the advisory carries the ID on its date today; on 35 Drupal and 11 ZDI records the ID did not yet exist on the advisory date and those are excluded, and whether an advisory carried the ID on its first day we could not check. For part of Red Hat the proxy does not hold, as said above; VulnCheck is outside the set. The 2,469 scored records with no own-site reference (527 late) are shown only in the all-records line.
• The rule says 72 hours; we count whole days from the public date and call a record late at four or more, which forgives up to a day. The time of day in datePublic is a form default at some CNAs, so an hour-level comparison would be false precision.
• Dell is read in India time on the strength of its timestamps and four sampled records, as the Details say; the shift moves 125 of its public dates by a day and turns 8 late records on time. No other CNA is shifted. A CNA whose public dates sit in a time zone west of UTC could show one extra day of lag on records published around midnight.
• The archive is one night’s snapshot, taken at midnight before 11 October 2026, and the newest record in it is dated 10 October; the quarter now in progress will grow. A record whose public date the CNA edited after publication is read as it stands now, not as it stood when published.
• Records are grouped by the year in the ID, 2025 or 2026, not the year they were published; a 2024 ID published in 2025 is outside the set. The quarter table groups by publication quarter, so a record not yet published is invisible and the newest quarters read low; the closing test is the share for quarters a month or more old, and an advisory that never gets a record never appears here.
• Earlier work we found measures neighbouring things. A 2026 arXiv paper on 245,456 records measures disclosure-to-remediation time for critical CVEs, not this rule.⁹ A GitHub community discussion of June 2026 is about CVE assignment taking longer than “the typical 72-hour SLA”, the assignment step, a different clock.⁸ Drupal’s own tracking issue counts Drupal’s records against the same rule we use, for Drupal only.⁷

Run it yourself

The script uses only Python’s standard library and reads the archive without unpacking it. The archive is 624 MB and the scoring takes under a minute.

curl -L -o all_cves.zip.zip https://github.com/CVEProject/cvelistV5/releases/download/cve_2026-10-11_2000Z/2026-10-11_all_CVEs_at_midnight.zip.zip
unzip all_cves.zip.zip                       # yields cves.zip
curl -O https://markovianprotocol.com/measurements/sm-018/cve72.py
curl -O https://markovianprotocol.com/measurements/sm-018/exhibits/own_domains.json
python3 -I cve72.py cves.zip out/ own_domains.json   # prints the summary; writes out/cve72_summary.json and out/cve72_rows.json

The archive’s SHA-256 as we read it: 327d95ef0859b87a091a27484f288e6529988d297b89aa9cd6506ac71232cf44 (outer zip), 50309e0ce3e7971fafc581b5cb52e379d5937dda2980485202da07035640220a (cves.zip inside it). Any night’s archive from the same release page will do for a rerun; the numbers move as records are published.

Ran it? Send the number you got and the date to hello@markovianprotocol.com, subject “Rerun SM-018”. We print it on the track record with your name, or just the date if you prefer, and the first outside rerun of each paper gets the same seal a CNA gets for answering or fixing.

What you can do with this

• If you run a CNA, your row is in cve72_by_cna.csv, and cve72_rows.json lists each of your records with both dates.
• If you wait on CVE records to drive patching, scanning or an SBOM check, the per-CNA table says whose advisories to read directly, because the record may follow by weeks.
• If you write about CVE timeliness, every number above comes from one public archive and one script; rerun it on tonight’s archive before quoting it.

References

1. CVE Program. CVE Numbering Authority (CNA) Operational Rules, version 4.2.0, effective 25 August 2026, section 4.5.1. cve.org/ResourcesSupport/AllResources/CNARules. Saved copies of v4.0 (effective 8 August 2024), v4.1.0 (14 May 2025) and v4.2.0 in the exhibits folder; accessed 2026-10-07.
2. CVE Program. cvelistV5, release cve_2026-10-11_2000Z, asset 2026-10-11_all_CVEs_at_midnight.zip.zip, 624,481,513 bytes, published 2026-10-11T20:29:19Z. github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-11_2000Z. Retrieved 2026-10-11; hashes in dataset_provenance_2026-10-11.txt.
3. CVE Program. CVE Record Format, JSON schema version 5.2.0, descriptions of datePublished, datePublic and dateReserved. github.com/CVEProject/cve-schema. Saved copy CVE_Record_Format.json.
4. CVE Program. List of Partners, roster data file CNAsList.json, 555 entries. cve.org/PartnerInformation/ListofPartners. Retrieved 2026-10-11 from the site’s source repository; saved copy CNAsList.json.
5. Zero Day Initiative. ZDI-25-950, 7 October 2025. zerodayinitiative.com/advisories/ZDI-25-950. Dell. DSA-2025-153, initial release 21 July 2025. dell.com/support/kbdoc/en-us/000300450. Arista. Security Advisory 0126, 18 November 2025. arista.com. Drupal. SA-CONTRIB-2026-031, 1 April 2026. drupal.org/sa-contrib-2026-031. All read 2026-10-11; saved copies in sm-018/exhibits/advisories/.
6. The second-path check, 175 records against 150 advisory pages: scripts, every page read, retrieval logs with hashes, and per-record results. sm-018/secondpath/: zdi/zdi_sample.csv, arista/arista_datepublic_check.csv, dell/dell_datepublic_check.csv, drupal/results.csv, drupal/independent_clocks.json, and for the 2025 IDs 2025/results.csv with 2025/check2025.py.
7. Drupal.org, project security.drupal.org, issue 3589998, Plan for how to meet 72 hour publication obligation (CNAv4.1 section 4.5.1.4), opened 2026-05-13. drupal.org/project/securitydrupalorg/issues/3589998. Saved copy drupal_issue_3589998.json.
8. GitHub Community, discussion 200225, CVE assignment pending past 72-hour SLA for published advisory, 26 June 2026. github.com/orgs/community/discussions/200225. Saved copy github_discussion_200225.html.
9. Sinterhauf, L., Aßmuth, A. and Kaltefleiter, R. CVEs With a CVSS Score Greater Than or Equal to 9, arXiv:2604.20765, 2026. arxiv.org/abs/2604.20765. Saved copy of the abstract page arxiv_2604.20765.html.

Cite as

@misc{markovian-sm018,
  author = {{Markovian Protocol}},
  title  = {Time from a CNA's own disclosure date to CVE List publication, every published
            2025 and 2026 record with a usable public date, against CNA Operational Rules 4.5.1.4},
  number = {SM-018},
  year   = {2026},
  month  = oct,
  url    = {https://markovianprotocol.com/measurements/sm-018.html},
  doi    = {10.5281/zenodo.23305970}
}