Under Collaborative Vulnerability Metadata Acceptance Process (CVMAP) for CVE Numbering Authorities (CNAs) and Authorized Data Publishers (NISTIR 8246), Section 4:
The current NVD analyst workflow for a single CVE record consists of two primary stages:
- Initial Analysis and
Initial Analysis involves an NVD analyst investigating the information provided for the CVE record to better understand the vulnerability’s characteristics. This analysis is primarily focused on the CVE description and attached resource links to external publicly verifiable information. From this information, the NVD analyst develops initial CVSSv2 and CVSSv3.1 vector strings, associates CWE(s) with the CVE record, determines the appropriate Reference Link Tags, and builds the configurations using matching criteria defined in the Common Platform Enumeration (CPE) 2.3 specification.
Once the Initial Analysis is complete, the analyzed metadata for the CVE record is then reviewed by a second—usually more experienced—NVD analyst during the Verification stage. This ensures that proper standards and procedures have been applied to the analysis of CVE record metadata based on the information supplied. Once the analyzed CVE record has been reviewed and approved, the CVE record metadata is then published for public access.
Under the Collaborative Vulnerability Metadata Acceptance Process (CVMAP), Section 10.5 it is stated:
Configuration assessments are not yet occurring as part of CVMAP. We will make an announcement when this functionality is officially included.
It would seem one is at the mercy of the timetable of NVD analysts for a CVE's CPE information.