A CVE record is the public entry that names a software vulnerability. I wanted to know whether a record on its own lets a defender answer three things: am I affected, am I exposed, and what do I do about it.
I drew a hundred records at random from those published between June and August 2026, and fixed the plan and the pass mark before I started. Two AI coders scored each record twice, once from the description alone and once from the whole record. Taking the whole record, 64 of 100 were enough to act on, and both coders cleared the pass mark, so the common claim that records generally fall short doesn't hold here. The description alone usually isn't enough: most don't say how an attacker gets in or which fix to apply. The biggest single gap is the fix. Of the 36 records that fell short, 26 didn't say which version or patch resolves the problem.
That 64 is thinner than it looks. In 14 of them the severity data came only from CISA, and 90 of the 100 records carried CISA-added data. My scoring rules also counted a severity score's attack-vector and privileges-required values as telling a defender how exposed they are, when those are really the scorer's assessment of the flaw rather than a statement about anyone's deployment. Both coders were Claude models, so their agreement isn't independent confirmation, and on the description-only judgement they disagreed badly: one said 39 records were sufficient, the other said 5.
The CVE Program's own rules now say the description matters less than it used to and that versions belong in structured fields, which matches what I found, so defenders and tools should be reading those fields rather than the prose. I checked whether information is present, not whether it's correct, and earlier research finds version data is often wrong.