Based on something @cR0w@infosec.exchange mentioned I wanted to know: Are there CVE records are out there with E:[UP] but that are eitw? Well, yes. One or two. Or three: https://www.cve.org/CVERecord?id=CVE-2026-68820https://www.cve.org/CVERecord?id=CVE-2026-55040https://www.cve.org/CVERecord?id=CVE-2026-50522https://www.cve.org/CVERecord?id=CVE-2026-45659https://www.cve.org/CVERecord?id=CVE-2026-41091https://www.cve.org/CVERecord?id=CVE-2026-33824https://www.cve.org/CVERecord?id=CVE-2026-21525https://www.cve.org/CVERecord?id=CVE-2026-21519https://www.cve.org/CVERecord?id=CVE-2026-21513https://www.cve.org/CVERecord?id=CVE-2026-20805 (and many more that aren't CVE-2026-*). ... ok, are there any that aren't MS? Yes, a handful: https://www.cve.org/CVERecord?id=CVE-2025-68686https://www.cve.org/CVERecord?id=CVE-2023-48788https://www.cve.org/CVERecord?id=CVE-2022-42475https://www.cve.org/CVERecord?id=CVE-2021-44168https://www.cve.org/CVERecord?id=CVE-2020-4428https://www.cve.org/CVERecord?id=CVE-2020-4427 For no particular reason: 4.5.3.1 CNAs SHOULD update published CVE Records when information material to the Record changes, for example, when a Fix becomes available. (data may be incomplete & some FPs may have slipped through, this was some quick & dirty regex work)