It's not a press embargo in the sense that the whole package of information becomes public once the embargo expires. There will be a published record on the cve.org, but often those who initiated the embargo insist that key details related to the vulnerability remain private even after the existence of the vulnerability and its remediation have been published.

Consider this example:

https://www.cve.org/CVERecord?id=CVE-2026-113119

At this time, the corresponding Chromium bug tracker entry is still private:

https://issues.chromium.org/issues/557075191

(I just picked this one at random, I haven't checked if the information is publicly available from another source.)

No, a CVE being assigned or allocated can happen well in advance. It's just requesting an identifier and it can be reserved very early.

For example: https://www.cve.org/CVERecord?id=CVE-2026-50000

No, CVEs can be allocated before a vulnerability has even been found!