The CVE Numbering Authority (CNA) Operational Rules Version 4.2.1 took effect on October 20, 2026, after community input and review. The previous version, CNA Rules v4.2.0 , has been deprecated. CNAs are now required to comply with the CNA Rules v4.2.1 . CNA Rules v4.2.1, which was updated to improve the clarity of the rules regarding CVE ID assignment, was approved by the CVE Board on October 14, 2026. A detailed report is available that lists all changes between Version 4.2.0 and Version 4.2.1. Changes for CNA Rules v4.2.1 include the following clarifications: Section 4.1, Vulnerability Determination was updated to add the following text to the third paragraph: “Vulnerability determination