The CNA assigns the information a CVE ID, and writes a brief description and includes references. Then the new CVE is posted on the CVE website. Often, a CVE ID is assigned before a security advisory is made public. It's common for vendors to keep security flaws secret until a fix has been developed and tested.