Loading story…
CISA has issued its CVE Program: Establishing a Quality Era Framework, proposing a modernization effort to improve the reliability, responsiveness, and consistency of Common Vulnerabilities and Exposures records. The framework addresses surging disclosure volume, including more than 67,000 CVEs published by September 18 and an estimated 96,000 by year-end, as well as AI-enabled vulnerability discovery. It organizes improvement efforts around four interdependent areas: program governance, global ecosystem participation, operational data infrastructure, and CVE record content.
The agency plans continued engagement with CVE Numbering Authorities, researchers, software suppliers, and vulnerability-data consumers, with further implementation details to be published through cve.org. Security experts welcomed CISA's recognition of persistent data-quality issues, but noted that the framework does not yet set measurable targets or deadlines and leaves questions about transparency and requirements for machine-readable software identifiers. The initiative follows substantial growth in vulnerability reporting, with NIST reporting a 263% increase in CVE submissions between 2020 and 2025.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
CISA published "The CVE Program: Establishing a Quality Era Framework," outlining a transition from a growth-focused phase to improving the reliability, responsiveness, and quality of CVE vulnerability data. The framework identifies program governance, ecosystem participation, data infrastructure, and CVE record content as four interdependent quality dimensions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA has released a new strategic vision for the Common Vulnerabilities and Exposures (CVE) program, aiming to shift from a 'growth era' to a 'quality era' focused on data quality, automation, and broader community engagement. The move follows a near-shutdown of the program due to federal funding threats and ongoing internal turmoil, including significant budget cuts and staff losses at CISA. Industry experts and stakeholders express concerns about the agency's ability to deliver on its roadmap and the future governance of the CVE program, as debates continue over public versus private stewardship and diversified funding.
Jun 29, 2026CISA has confirmed continued support and funding for the Common Vulnerabilities and Exposures (CVE) program through March 2026. The agency outlined plans to modernize the program, diversify funding, and enhance multi-sector collaboration and data quality. CISA emphasized the importance of keeping CVE data free, vendor-neutral, and globally accessible.
Jun 29, 2026
CISA said the **Common Vulnerabilities and Exposures (CVE) Program** should be placed on firmer legal footing, but warned Congress not to impose overly prescriptive rules that could limit the program’s ability to adapt. The debate follows a 2025 funding scare tied to MITRE’s contract, which exposed the risk of relying on a single U.S. federal agreement to support a vulnerability identification system used globally. Agency officials said CVE governance must stay flexible as **artificial intelligence** accelerates vulnerability discovery and as the ecosystem becomes more internationally distributed. CISA pointed to proposals that would authorize CVE within the Department of Homeland Security, formalize CISA’s role, require a modernization plan with **NIST**, and establish a 15-member governing board, while also noting **ENISA’s** expanding role as both a CVE Numbering Authority and a CVE Root as evidence that the program is moving toward a more federated global model.
Aug 7, 2026