The policy, and what changed

The policy states the expectation plainly:

A CVE Record should be published within 72 hours of either (a) disclosure by the CNA or (b) the CNA becoming aware of a third-party disclosure, as applicable.

and aligns itself to two CNA Operational Rules sections:

• 4.5.1.4: CNAs MUST publish within 72 hours of publicly disclosing a CVE ID they assigned. Past that, the CNA's Root may direct a CNA-LR to publish.
• 4.5.1.6: CNAs SHOULD publish within 72 hours of becoming aware that a third party disclosed.

Rule 4.5.3.5 is also relevant: CNAs MUST reject unused or unpublished CVE IDs. A long-lived reservation is not a neutral state under the rules.

Four levers, which the Program “may take” and which “may be applied individually or combined”: Warning, Reservation Caps, Intervention, Formal Review. Remediation deadlines are set case by case by a TL-Root or Root.

Parts of it are mandatory, and quoting only the discretionary parts would be selective. The policy says a Root will notify the CNA of the affected IDs and the required remediation timeline; that CNAs MUST prioritise requests from their Root to publish RBPs identified as critical; and that repeated violations may escalate “up to and including CNA decertification”.

So the accurate claim is narrower than “no enforcement”, and it is the one that survives contact: the process runs inside the Program and is not visible in public data. There is no public RBP list, no public record that a CNA was notified, and no public enforcement log.

One factual note for anyone searching: RBP Policy v1.0 is not in force. It was removed from cve.org in January 2022 at the Program Lead's direction pending a new version (cve-website #835), and v2.0.0 is that replacement. Copies of v1.0 are still mirrored by third parties and still rank in search, and its 5% and 50% thresholds should not be cited. This project cited them itself before checking, which is how we know how easy that is.

Ask the CVE Services API about a reserved ID and the assigner is withheld:

GET /api/cve-id/CVE-2026-2574
{"state":"RESERVED","owning_cna":"[REDACTED]"}

The same field is populated for a published ID. For a reserved one it is not.

The field is populated and served, and withheld for reserved IDs. Being precise about scope: that redaction covers every reserved ID, on the order of tens of thousands for 2026 alone, and the overwhelming majority of those are not RBP at all. The endpoint cannot tell which are, so a blanket rule is the only rule it can apply.

Rule 4.5.1.7 governs the Secretariat's own conduct. It is not this site's permission to name anyone, and the site does not claim it as one. What it does establish is that the Program already contemplates naming a reserving CNA once an ID has been public for 24 hours.

This site does not publish inferred ownership. Estimating it from public data is possible, and the same block-boundary reasoning that recovers one owner would work across the entire reserved space, which is a good reason for the redaction to stay as it is. So the rows here carry the identifier and the advisories it appears in, and leave attribution to the Program.