SECOND MEASUREMENT SM-018

A CVE numbering authority has 72 hours to publish the record once it has made the CVE ID public itself. ZDI, Dell, Drupal and Arista were past that on {{F4L}} of the {{F4S}} records we could score since January 2025, by a median of {{F4MED}} days

Markovian ProtocolMeasured 2026-10-11Status: published 2026-10-11; questions sent to the four CNAs 2026-10-12; the Secretariat’s go through the Program’s formDOI: {{DOI}}

Every CVE record names the organisation that assigned the ID, a CVE Numbering Authority, and most carry two dates: the day the CNA says the vulnerability became public and the day the record reached the CVE List. The CNA Operational Rules, in force since August 2024, say a CNA must publish the record within 72 hours of making a CVE ID public itself. We read both dates on every published record with a 2025 or 2026 ID in the CVE List’s own archive, {{PUB}} records, and scored the {{SCORED}} with a usable public date. Among the {{OWN}} whose CNA points at its own site, {{OWNLATE}} reached the list more than three days after the CNA’s own public date ({{OWNLATEPCT}}), {{OWN30}} more than a month after. Four CNAs we checked against their own advisory pages carry {{F4L}} of those: ZDI {{ZL}} of {{ZS}}, Dell {{DL}} of {{DS}}, Drupal {{RL}} of {{RS}}, Arista {{AL}} of {{AS}}. Microsoft was past it on {{ML}} of {{MS}}. The rule’s remedy is that the CNA’s Root may have the CNA of Last Resort publish the record instead. In the Program’s glossary a Root is “an organization authorized within the CVE Program that is responsible, within a specific Scope, for the recruitment, training, and governance” of CNAs; the Secretariat is the organisation that runs the Program’s infrastructure and gives “administrative and logistical support” to its Board and working groups; a CNA of Last Resort, CNA-LR in the rules, is “a CNA authorized by a Root to assign CVE IDs and to publish corresponding CVE Records within that Root’s scope for vulnerabilities not covered by the Scope of another CNA” (glossaryEntries.json, the Glossary page’s data). For ZDI, Dell, Drupal and Arista the Root is MITRE, which is also their CNA of Last Resort and the Secretariat.

The short version

CNA Operational Rules 4.5.1.4: “CNAs MUST publish a CVE Record to the CVE List within 72 hours of Publicly Disclosing a CVE ID assigned by the CNA.” The same words have stood since version 4.0 took effect on 8 August 2024. 4.5.1.3 adds a SHOULD at 24 hours; 4.5.1.6 gives 72 hours as a SHOULD when someone other than the CNA disclosed the ID.¹
The CVE List publishes its whole record set as a zip each night. In the 11 October 2026 archive, {{PUB}} records with a 2025 or 2026 ID are published. {{WITHPUB}} carry the optional datePublic field, the CNA’s own statement of when the vulnerability became public. We exclude {{DROPRES}} whose public date is more than a day before the day the ID was reserved, since the ID did not exist to be disclosed, and {{DROPAFTER}} whose public date is more than a day after the record went up, since the clock had not started; {{KEPTRES}} and {{KEPTAFTER}} inside those one-day tolerances are kept. That leaves {{SCORED}} records from {{NCNA}} CNAs, scored as the day the record was published minus the day the CNA says it disclosed.
The MUST applies when the CNA made the ID public itself. We take a CNA citing its own site in the record as the sign of that, where its site means a domain the Program’s partner roster lists for the CNA (advisory page, policy page or contact address) or one we mapped by hand; {{MAPPED}} of the {{NCNA}} scored CNAs have one. That gives {{OWN}} records from {{NOWN}} CNAs. {{OWNSD}} of them ({{OWNSDPCT}}) were on the list the same day as the public date and {{OWNW1}} ({{OWNW1PCT}}) by the next day. {{OWNLATE}} ({{OWNLATEPCT}}) were more than three days late, {{OWN30}} more than 30 days, {{OWN90}} more than 90. The median late record took {{OWNMED}} days. Published in 2025: {{O25L}} of {{O25S}} late ({{O25P}}). Published in 2026, to 10 October: {{O26L}} of {{O26S}} ({{O26P}}).
Four CNAs were checked by a second path, their own advisory pages: 175 records against 150 advisory pages, since some Dell and Arista advisories carry several IDs. For 135 records with 2026 IDs the record’s public date is the advisory’s date for 34 of 35 at ZDI (one a day apart), 35 of 35 at Arista, 31 of 35 at Dell within a day, 30 of 30 at Drupal to the minute; for ten 2025 IDs at each CNA, 37 of 40 match within a day. The four published {{F4PUB}} records with 2025 and 2026 IDs; {{F4S}} carry a public date we could score. {{F4L}} of those {{F4S}} were late ({{F4P}}), {{F430}} by more than 30 days, {{F490}} by more than 90; the longest, a Dell BIOS record, {{F4MAX}} days.
The clean end of the table: Microsoft {{ML}} of {{MS}} late ({{MP}}), Adobe {{ADL}} of {{ADS}} ({{ADP}}), F5 3 of 167; {{ZEROLATE}} CNAs with thirty or more records have no late record at all.
The numbers point at batching. ZDI’s {{ZS}} records went to the list on {{ZD}} distinct days, {{ZTOP}} of them on 21 July 2025; Drupal’s {{RS}} on {{RD}} days, {{RTOP}} on 10 July 2026.

Disclosure: Markovian Protocol holds no financial position in any organisation named here, was paid by no one for this work, and showed it to no one before publication. How we work.

Details

A CVE record is written by the CNA that assigned the ID and published to the CVE List through the Program’s services; the list stamps it with datePublished. The record format also has an optional field the CNA fills in itself, datePublic, “if known, the date/time the vulnerability was disclosed publicly”.³ The rule’s clock starts when the CNA publicly discloses the CVE ID; for a vendor or a bug-bounty program that means the day its own advisory, carrying the ID, went up. So the question has a second path that does not go through anyone’s self-report: take the CNA’s own public date from the record, confirm on a sample that it is the date on the CNA’s advisory page, and subtract it from the list’s publication stamp. We did that for every published record with a 2025 or 2026 ID in the CVE List’s nightly archive.² Four rules came out of the advisory check and are applied throughout; the own-site map is own_domains.json, built by build_own_domains.py from the roster. The comparison is at day resolution, because at some CNAs the time of day in datePublic is a form default (Dell’s reads 06:30 UTC on 373 of its 723 published records and 17:00, 18:00 or 18:30 on most of the rest; Arista leaves the field out on 50 of its 103 and gives midnight on 17 of the 53 that have it), so a record is late here when the list date is more than three whole days after the public date, which is more lenient than 72 hours. Dell’s timestamps are read in India time (UTC+5:30): its public dates fall at 06:30 UTC on 373 of its records and 18:30 on 102, noon and midnight in India, and on 4 of 35 sampled records the UTC date is the day before the advisory date. That is our inference from the timestamps, not something Dell’s pages say; it moves {{DELLMOVED}} of Dell’s {{DS}} public dates forward a day and turns {{DELLFLIP}} late records into on-time ones. A public date more than a day before the ID’s reservation date is excluded, since the ID did not exist to be made public; this is not always a typo. It removes {{DRDRUPAL}} of Drupal’s records and {{DRZDI}} of ZDI’s where the advisory went up first and the ID was reserved 2 to 239 days later, 42 of the 46 published on the day of reservation, so the advisory did not carry the ID on its date, and it caught the one hard error in the samples, a Dell record dated 9 March for an advisory of 3 September. Every record this rule removes from the four would have counted late. And a public date more than a day after publication is excluded, since the rule’s clock had not started. Whether a CNA made the ID public itself is read from the record’s references: a CNA that cites a domain the Program’s roster lists for it, or one we mapped by hand, is counted as its own discloser (own_domains.json). That proxy is right for the four CNAs we checked, and where Dell’s public date is a later change to the advisory rather than its first release the error runs in Dell’s favour: three sampled records score 1, 3 and 5 days late from the public date and would score 3, 13 and 22 from the initial release. For Red Hat the proxy is weak in a known direction, which the per-CNA section says, and VulnCheck is left out of the own-site set on purpose, for the reason given there.

What the rule says, what we found

The rule	We found
CNA Operational Rules 4.5.1.4: “CNAs MUST publish a CVE Record to the CVE List within 72 hours of Publicly Disclosing a CVE ID assigned by the CNA. If the CNA does not publish within 72 hours, then the CNA’s Root MAY direct the appropriate CNA-LR to publish a CVE Record for the assigned CVE ID. Ownership of the CVE Record MAY be transferred.”¹ Unchanged in wording from version 4.0 (effective 8 August 2024) through 4.1.0 (14 May 2025) and 4.2.0 (25 August 2026).	{{OWN}} records where the CNA cites its own site, {{NOWN}} CNAs: {{OWNLATE}} published more than three days after the CNA’s own public date ({{OWNLATEPCT}}); {{OWN30}} more than 30 days after.
4.5.1.3: “CNAs SHOULD publish a CVE Record to the CVE List within 24 hours of Publicly Disclosing a CVE ID assigned by the CNA.”	{{OWNSD}} of {{OWN}} ({{OWNSDPCT}}) were on the list the same calendar day as the public date; {{OWNW1}} ({{OWNW1PCT}}) by the next day. The 24 hours lie between.
4.5.1.6: “CNAs SHOULD publish CVE Records within 72 hours of becoming aware that a CVE ID assigned by the CNA has been Publicly Disclosed by a party other than the CNA.”	All {{SCORED}} scored records, own disclosure or not: {{ALLLATE}} late ({{ALLLATEPCT}}), {{ALL30}} more than 30 days.

Quarter by quarter

Quarter published	Records	Within a day	Late	Share late	Over 30 days

Records whose CNA cites its own site, by the quarter the record reached the CVE List, newest first. The newest row covers 1 to 10 October 2026, the last day in the archive. “Late” is more than three whole days between the CNA’s public date and the list’s publication date. The newest quarters read low: a record that has not yet been published is not in the archive at all, so a CNA that has not run its batch shows no late records rather than many. Every row: cve72_by_quarter.csv.

Four CNAs, checked against their own pages

A record’s public date is the CNA’s own entry, so before trusting it we read the advisory each record cites and compared dates: 35 records each at ZDI, Arista and Dell and 30 at Drupal, all 2026 IDs; then ten 2025 IDs at each of the four, spread across the year. Of the 40 from 2025, 37 match within a day; two Dell records carry the date of a later revision of an older advisory, one the revision that says new CVEs were added and the other the revision two days after the one that says so, and one Arista record is dated a month after its advisory while its two siblings on the same page carry the advisory’s date. The scripts, every page read, the retrieval logs and the per-record results are in sm-018/secondpath/ (the 2025 set under 2025/).

CNA	Records read against their advisory (2026 + 2025 IDs)	Record date vs advisory date	Published 2025–26 (with a public date)	Scored	Within a day	Late	Share late	Over 30 days	Median late, days	Distinct publish days

Scored records are the CNA’s published 2025 and 2026 records with a public date, less those excluded by the reservation rule (Drupal {{DRDRUPAL}}, ZDI {{DRZDI}}, Dell {{DRDELL}}, Arista {{DRARISTA}}) and, for Drupal one and for Arista three, with no reference to the CNA’s own site. Each CNA’s Top-Level Root is MITRE, and MITRE is also the CNA of Last Resort the rule names (CNAsList.json, the Program’s partner roster, 11 October 2026).

Zero Day Initiative. Trend Micro’s bug-bounty program publishes an advisory page per finding with the date and the CVE ID on it. ZDI-25-950, a 7-Zip code-execution bug, is dated 7 October 2025; its record, CVE-2025-11002, reached the list on 23 January 2026, 108 days later, in a batch of 47 ZDI records that day. {{ZL}} of ZDI’s {{ZS}} records were late ({{ZP}}); they went up on {{ZD}} distinct days, {{ZTOP}} of them on 21 July 2025. In the 35 sampled, 34 public dates equal the advisory’s date and one is a day later, ZDI-26-551, dated 11 August 2026 with a record public date of 12 August.

Dell. Dell’s security advisories carry a revision table with an initial-release date. DSA-2025-153, a client-BIOS password-recovery weakness, shows “1.0 · 2025-07-21 · Initial Release”; its record, CVE-2025-36579, was published on 16 April 2026, 269 days later. Dell was late on {{DL}} of {{DS}} ({{DP}}), on {{DD}} distinct publish days, so its batches are smaller and more frequent than ZDI’s. Of the 35 sampled, 24 public dates equal the initial-release date exactly, 4 equal it once read in India time, 3 are two days after it in India time (one in UTC), and 3 are 2, 10 and 17 days after it; in all three of those the advisory page was changed on the record’s public date, two by a numbered revision and one by its last-modified date, and in one the ID was reserved after the initial release, so the ID may have been added at the change. The 35th, DSA-2026-360, carries a public date of 9 March 2026 for an advisory first released on 3 September; the ID was reserved in August, so the reservation rule drops it.

Drupal. Drupal’s security team publishes advisories as drupal.org nodes whose creation time is the record’s public date to the minute, for all 30 sampled. The Drupal security mailing list carries the same date for the three we matched there; the advisories’ RSS feed, which holds only recent items, agrees with node creation on eight recent advisories and on the two sampled ones it still listed; and of the 15 sampled advisories the Internet Archive has captured (11 of 30 queries failed and 4 found no capture), none was captured before its node was created. SA-CONTRIB-2026-031, an authentication bypass in a SAML module, went up on 1 April 2026 at 16:38 UTC; CVE-2026-5343 reached the list on 28 May, 57 days later. {{RL}} of {{RS}} were late ({{RP}}). Drupal’s own issue tracker has an issue for this, opened on 13 May 2026 in the security team’s issue queue and titled “Plan for how to meet 72 hour publication obligation (CNAv4.1 section 4.5.1.4)”; it lists thirteen records by advisory date, CVE-2026-5343 among them, with the days the published ones took.⁷

Arista. Arista’s advisories carry a date and a revision table. Security Advisory 0126, three CloudVision Exchange issues, is dated 18 November 2025; two of its records, CVE-2025-5088 and CVE-2025-5090, were published on 5 June 2026, 199 days later. Arista is the smallest of the four, {{AL}} of {{AS}} late ({{AP}}), and 35 of 35 sampled public dates equal the advisory date. The CNA reference on two sampled records pointed at URLs that now return an error; one advisory was read at the address NVD lists for it, the other at the same advisory under another address.

Every mapped CNA with thirty or more records

CNA	Records	Within a day	Late	Share late	Over 30 days	Median late, days	Distinct publish days	Records per day

{{NCT}} CNAs with at least 30 scored records that cite the CNA’s own site, most late first. One CNA with 30 or more scored records is outside the set: VulnCheck, left out on purpose (below). Every CNA, with and without own-site references: cve72_by_cna.csv; every scored record: cve72_rows.json.

Two CNAs need reading with care. VulnCheck is not in the table on purpose. It assigns IDs for vulnerabilities that other people disclosed, on GitHub and elsewhere; its public date is not the date of a VulnCheck advisory (the HestiaCP record CVE-2025-30008 gives 22 December 2025; the VulnCheck advisory it cites is dated 10 July 2026, the day the record was published; the fix pull request it cites was merged on 29 December 2025 and the fixed release came out on 28 May 2026; saved copies advisory, pull request, release), so its {{VL}} late of {{VS}} scored belong under the SHOULD of 4.5.1.6, not the MUST, and they sit in the all-records line only. Red Hat’s public date is the public date of its own security data (the podman record CVE-2025-11395 gives 7 November 2025 and Red Hat’s API gives the same day, saved copy), which for an upstream open-source project can be the upstream’s disclosure rather than Red Hat’s own, and every Red Hat record cites redhat.com, so the same may apply to part of its {{RHL}} of {{RHS}}. Microsoft, Adobe and F5 publish the record within a day of their own advisory on 96 to 99% of theirs.

The longest waits

CNA	Record	Title	Public date	Published	Days

Fifteen longest gaps among records whose CNA cites its own site; the cut falls inside a tie of two Arista records at 199 days from one advisory, of which the first by ID is shown. Title as the CNA wrote it. The records as published, saved from the archive: sm-018/exhibits/records/.

How this ends

Two acts close it. The CNA publishes the record the day its advisory goes out, which for a batching CNA means running the batch on advisory day rather than on a calendar; the monthly reads see that as a late share near zero for each quarter once it is a month or more old, since the newest quarter cannot yet show the records that have not been published. Or the rule’s own remedy runs: the CNA’s Root, MITRE for all four named here, directs the CNA of Last Resort to publish the record, and the record’s provider changes. We re-pull the nightly archive on the first of each month, re-score every record, and print the result here, per quarter and per CNA.

The evidence

Every quote below was checked against a saved copy. Copies and SHA-256 hashes: SHA256SUMS.

Exhibit 1 · The rule

“4.5.1.4 CNAs MUST publish a CVE Record to the CVE List within 72 hours of Publicly Disclosing a CVE ID assigned by the CNA. If the CNA does not publish within 72 hours, then the CNA’s Root MAY direct the appropriate CNA-LR to publish a CVE Record for the assigned CVE ID. Ownership of the CVE Record MAY be transferred. See also 4.2.1.2.”

CNA Operational Rules v4.2.0, effective 25 August 2026 · saved copies CNA_Rules_v4.2.0.pdf, v4.1.0 (effective 14 May 2025), v4.0 (effective 8 August 2024); the same section in all three

Exhibit 2 · The two neighbouring rules

“4.5.1.3 CNAs SHOULD publish a CVE Record to the CVE List within 24 hours of Publicly Disclosing a CVE ID assigned by the CNA. … 4.5.1.6 CNAs SHOULD publish CVE Records within 72 hours of becoming aware that a CVE ID assigned by the CNA has been Publicly Disclosed by a party other than the CNA.”

Same document, same saved copy

Exhibit 3 · The two dates

“datePublished: The date/time the CVE Record was first published in the CVE List. … datePublic: If known, the date/time the vulnerability was disclosed publicly.”

CVE Record Format, JSON schema 5.2.0, field descriptions · saved copy CVE_Record_Format.json

Exhibit 4 · One record, as the archive holds it

"cveMetadata": { "cveId": "CVE-2025-11002", "assignerShortName": "zdi",
                 "dateReserved": "2025-09-25T18:50:55.181Z",
                 "datePublished": "2026-01-23T02:47:05.205Z", "state": "PUBLISHED" }
"containers": { "cna": { "datePublic": "2025-10-07T21:26:07.793Z",
                 "references": [ { "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-950/" } ] } }

cvelistV5 archive cve_2026-10-11_2000Z, cves/2025/11xxx/CVE-2025-11002.json, fields abridged · saved copy CVE-2025-11002.json

Exhibit 5 · The same bug on the CNA’s own page

“7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability · October 7th, 2025 · ZDI-25-950 · ZDI-CAN-26743 · CVE ID CVE-2025-11002”

zerodayinitiative.com/advisories/ZDI-25-950/, read 2026-10-11 · saved copy ZDI-25-950.html

Exhibit 6 · Dell’s revision table

“DSA-2025-153: Security Update for Dell Client Platform BIOS for a Weak Password Recovery Mechanism Vulnerability … Revision History · 1.0 · 2025-07-21 · Initial Release”

dell.com/support/kbdoc/en-us/000300450/dsa-2025-153, read 2026-10-11; the record CVE-2025-36579 carries datePublic 2025-07-21T17:00:00.000Z and datePublished 2026-04-16T16:05:32.561Z · saved copies dell-dsa-2025-153.html, CVE-2025-36579.json

Exhibit 7 · Drupal’s own tracking issue

“Plan for how to meet 72 hour publication obligation (CNAv4.1 section 4.5.1.4) … Currently there are a number of SA’s that have a CVE ID’s allocated, publicly and publicly disclosed however not published to the CVE registry. … CVE-2026-4093 - March 18th … Published May 21st - ~62 days … CVE-2026-5343 - April 1st”

drupal.org issue 3589998, project security.drupal.org, opened 2026-05-13, read 2026-10-11 through the site’s API (the HTML page sits behind a JavaScript challenge) · saved copy drupal_issue_3589998.json; the advisory node drupal-sa-contrib-2026-031.node.json, created 2026-04-01T16:38:14Z

Exhibit 8 · Arista’s advisory date

“Security Advisory 0126 … Date: November 18, 2025 · 1.0 · November 18, 2025 · Initial release”

arista.com/en/support/advisories-notices/security-advisory/22868-security-advisory-0126, read 2026-10-11 (the site answers a browser user-agent with HTTP 406; read with curl’s user-agent) · saved copy arista-security-advisory-0126.html; records CVE-2025-5090.json, CVE-2025-5088.json

Our questions

For the four CNAs named above and for the CVE Program’s Secretariat. Answers will be printed here as written.

To ZDI, Dell, Drupal and Arista: is the date on your advisory the day the CVE ID became public, and is the record’s datePublic meant to be that day? What sets the interval between an advisory and its record reaching the list?
To the Secretariat: since 4.5.1.4 took effect on 8 August 2024, has any Root directed a CNA of Last Resort to publish a record under it? Does the Program measure the interval, and if so from which field?
To the Secretariat: {{AFTERANY}} records carry a public date after their publication date, 7,981 of them from Patchstack. Is a record published before the date it gives for disclosure inside the format’s intent?

Their reply, scored

What we told whom, and when.

11 Oct 2026	Published and stamped in the log. Nobody saw the page before that.
12 Oct 2026	One note each to ZDI, Dell, Drupal and Arista, at the contact the Program’s roster lists for each: the CNA’s own numbers, its five longest records, the script and its records as a CSV, and the two questions above. Replies go here as written.
pending	The three Program questions to the Secretariat, through the Program’s General Support form (cve.org’s contact page returns 404); the form needs a Google or GitLab login.

Four notes sent 12 October 2026; no reply yet. Day 30 is 11 November. The Secretariat form is not yet submitted.

What we can’t be sure of

datePublic is optional and {{WITHPUB}} of {{PUB}} records carry it. A CNA that leaves it blank is invisible here, late or not; the table ranks only CNAs that state a public date, and a CNA that stops stating one would drop out of it.
The field is the CNA’s own entry. Four CNAs were checked against their pages; the other 230 were not, and the comparison is only as good as the CNA’s habit of filling the field with the advisory date. Patchstack’s public date is later than its publication date on 7,981 records, so its records go up before the day it gives for disclosure, and they are dropped rather than counted as early. VulnCheck’s public date precedes the ID’s reservation on 3,983 records, which is what assigning IDs to old, already-public bugs looks like; those are dropped too.
Own-site citation is a proxy for “the CNA made the ID public itself”, and the rule’s MUST turns on that. The domains come from the Program’s roster and a hand list, {{MAPPED}} of the {{NCNA}} scored CNAs; a CNA with no domain listed is never counted as its own discloser. For ZDI, Dell, Drupal and Arista the advisory carries the ID on its date today; on {{DRDRUPAL}} Drupal and {{DRZDI}} ZDI records the ID did not yet exist on the advisory date and those are excluded, and whether an advisory carried the ID on its first day we could not check. For part of Red Hat the proxy does not hold, as said above; VulnCheck is outside the set. The {{NONOWN}} scored records with no own-site reference ({{NONOWNLATE}} late) are shown only in the all-records line.
The rule says 72 hours; we count whole days from the public date and call a record late at four or more, which forgives up to a day. The time of day in datePublic is a form default at some CNAs, so an hour-level comparison would be false precision.
Dell is read in India time on the strength of its timestamps and four sampled records, as the Details say; the shift moves {{DELLMOVED}} of its public dates by a day and turns {{DELLFLIP}} late records on time. No other CNA is shifted. A CNA whose public dates sit in a time zone west of UTC could show one extra day of lag on records published around midnight.
The archive is one night’s snapshot, taken at midnight before 11 October 2026, and the newest record in it is dated 10 October; the quarter now in progress will grow. A record whose public date the CNA edited after publication is read as it stands now, not as it stood when published.
Records are grouped by the year in the ID, 2025 or 2026, not the year they were published; a 2024 ID published in 2025 is outside the set. The quarter table groups by publication quarter, so a record not yet published is invisible and the newest quarters read low; the closing test is the share for quarters a month or more old, and an advisory that never gets a record never appears here.
Earlier work we found measures neighbouring things. A 2026 arXiv paper on 245,456 records measures disclosure-to-remediation time for critical CVEs, not this rule.⁹ A GitHub community discussion of June 2026 is about CVE assignment taking longer than “the typical 72-hour SLA”, the assignment step, a different clock.⁸ Drupal’s own tracking issue counts Drupal’s records against the same rule we use, for Drupal only.⁷

Run it yourself

The script uses only Python’s standard library and reads the archive without unpacking it. The archive is 624 MB and the scoring takes under a minute.

curl -L -o all_cves.zip.zip https://github.com/CVEProject/cvelistV5/releases/download/cve_2026-10-11_2000Z/2026-10-11_all_CVEs_at_midnight.zip.zip
unzip all_cves.zip.zip                       # yields cves.zip
curl -O https://markovianprotocol.com/measurements/sm-018/cve72.py
curl -O https://markovianprotocol.com/measurements/sm-018/exhibits/own_domains.json
python3 -I cve72.py cves.zip out/ own_domains.json   # prints the summary; writes out/cve72_summary.json and out/cve72_rows.json

The archive’s SHA-256 as we read it: 327d95ef0859b87a091a27484f288e6529988d297b89aa9cd6506ac71232cf44 (outer zip), 50309e0ce3e7971fafc581b5cb52e379d5937dda2980485202da07035640220a (cves.zip inside it). Any night’s archive from the same release page will do for a rerun; the numbers move as records are published.

Ran it? Send the number you got and the date to hello@markovianprotocol.com, subject “Rerun SM-018”. We print it on the track record with your name, or just the date if you prefer, and the first outside rerun of each paper gets the same seal a CNA gets for answering or fixing.

What you can do with this

If you run a CNA, your row is in cve72_by_cna.csv, and cve72_rows.json lists each of your records with both dates.
If you wait on CVE records to drive patching, scanning or an SBOM check, the per-CNA table says whose advisories to read directly, because the record may follow by weeks.
If you write about CVE timeliness, every number above comes from one public archive and one script; rerun it on tonight’s archive before quoting it.

References

CVE Program. CVE Numbering Authority (CNA) Operational Rules, version 4.2.0, effective 25 August 2026, section 4.5.1. cve.org/ResourcesSupport/AllResources/CNARules. Saved copies of v4.0 (effective 8 August 2024), v4.1.0 (14 May 2025) and v4.2.0 in the exhibits folder; accessed 2026-10-07.
CVE Program. cvelistV5, release cve_2026-10-11_2000Z, asset 2026-10-11_all_CVEs_at_midnight.zip.zip, 624,481,513 bytes, published 2026-10-11T20:29:19Z. github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-11_2000Z. Retrieved 2026-10-11; hashes in dataset_provenance_2026-10-11.txt.
CVE Program. CVE Record Format, JSON schema version 5.2.0, descriptions of datePublished, datePublic and dateReserved. github.com/CVEProject/cve-schema. Saved copy CVE_Record_Format.json.
CVE Program. List of Partners, roster data file CNAsList.json, 555 entries. cve.org/PartnerInformation/ListofPartners. Retrieved 2026-10-11 from the site’s source repository; saved copy CNAsList.json.
Zero Day Initiative. ZDI-25-950, 7 October 2025. zerodayinitiative.com/advisories/ZDI-25-950. Dell. DSA-2025-153, initial release 21 July 2025. dell.com/support/kbdoc/en-us/000300450. Arista. Security Advisory 0126, 18 November 2025. arista.com. Drupal. SA-CONTRIB-2026-031, 1 April 2026. drupal.org/sa-contrib-2026-031. All read 2026-10-11; saved copies in sm-018/exhibits/advisories/.
The second-path check, 175 records against 150 advisory pages: scripts, every page read, retrieval logs with hashes, and per-record results. sm-018/secondpath/: zdi/zdi_sample.csv, arista/arista_datepublic_check.csv, dell/dell_datepublic_check.csv, drupal/results.csv, drupal/independent_clocks.json, and for the 2025 IDs 2025/results.csv with 2025/check2025.py.
Drupal.org, project security.drupal.org, issue 3589998, Plan for how to meet 72 hour publication obligation (CNAv4.1 section 4.5.1.4), opened 2026-05-13. drupal.org/project/securitydrupalorg/issues/3589998. Saved copy drupal_issue_3589998.json.
GitHub Community, discussion 200225, CVE assignment pending past 72-hour SLA for published advisory, 26 June 2026. github.com/orgs/community/discussions/200225. Saved copy github_discussion_200225.html.
Sinterhauf, L., Aßmuth, A. and Kaltefleiter, R. CVEs With a CVSS Score Greater Than or Equal to 9, arXiv:2604.20765, 2026. arxiv.org/abs/2604.20765. Saved copy of the abstract page arxiv_2604.20765.html.

Cite as

@misc{markovian-sm018,
  author = {{Markovian Protocol}},
  title  = {Time from a CNA's own disclosure date to CVE List publication, every published
            2025 and 2026 record with a usable public date, against CNA Operational Rules 4.5.1.4},
  number = {SM-018},
  year   = {2026},
  month  = oct,
  url    = {https://markovianprotocol.com/measurements/sm-018.html},
  doi    = {{{DOI}}}
}