CVE-2023-7355
Summary
by MITRE • 08/06/2026
Rejected reason: Erroneously reserved under wrong year by automation defect; never assigned.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/06/2026
This CVE identifier represents a technical artifact that was erroneously reserved under an incorrect year due to an automation defect within the CVE assignment process. The vulnerability record was never actually assigned or validated, making it a non-existent entry in the official CVE database. Such errors typically occur when automated systems fail to properly verify the correct year context during the reservation process, leading to misallocation of CVE identifiers. The rejection indicates that this identifier was identified as invalid and subsequently removed from consideration for actual vulnerability assignment.
The technical flaw here lies not in a software or system vulnerability but in the administrative and process control mechanisms that govern CVE identifier management. This type of error demonstrates the critical importance of validation checks within automated systems that handle security identifier assignments. The automation defect likely occurred during the year verification phase where timestamp or calendar validation logic failed to properly route the reservation to the correct temporal context, resulting in a misfiled identifier.
From an operational perspective this rejected CVE entry represents a potential risk to security operations if the erroneous identifier was inadvertently used in documentation, threat intelligence feeds, or security tooling. Security teams might waste resources investigating non-existent vulnerabilities, creating false positives that could divert attention from legitimate security concerns. The incident highlights the need for robust quality assurance processes in security infrastructure management and underscores the importance of human oversight in automated systems handling critical security identifiers.
The implications extend to industry standards such as CWE categories related to process control failures and configuration management issues. This error aligns with CWE-1004 which addresses weaknesses in software that can lead to incorrect handling of identifiers or data structures. The incident also reflects ATT&CK technique T1588.001 for the sub-technique of obtaining capabilities, where malicious actors might attempt to exploit such identifier confusion for deception purposes. Proper mitigation requires implementing redundant validation checks, establishing clear audit trails for identifier reservations, and maintaining regular review processes to identify and correct such automation defects before they can impact security operations.
The root cause analysis reveals that this issue stems from inadequate testing of automated reservation systems and insufficient monitoring of the CVE assignment workflow. Organizations should implement comprehensive testing protocols that include temporal context validation, establish clear escalation procedures for anomalous identifier reservations, and maintain detailed logging of all identifier management activities to prevent similar automation defects from occurring in the future.