CISA Charts New "Quality Era" for Global CVE Program
CISA outlined a quality framework for the CVE program as 2026 disclosures approach a projected 96,000.
CISA published The CVE Program: Establishing a Quality Era Framework on September 22, arguing the program must shift from growth toward reliability, responsiveness, and vulnerability data quality. As of September 18, more than 67,000 CVEs had been published in 2026, and CVEForecast.org projects about 96,000 by year-end. The National Vulnerability Database reported a 263% increase in CVE submissions from 2020 to 2025, with first-quarter 2026 submissions one-third higher year over year. The framework defines four quality dimensions but presents only potential measures, with no targets or deadlines.
- More than 67,000 CVEs were published in 2026 by September 18, with 96,000 projected.
- NVD CVE submissions rose 263% between 2020 and 2025.
- Quality covers governance, participation, data infrastructure, and record content.
- Proposed measures include no targets or deadlines.
- AI-accelerated discovery is straining triage, disclosure, and CVE assignment.
Full article455 words · extracted from infosecurity-magazine.com · click to collapse
CISA has set out a framework for improving the quality of CVE data, arguing that the vulnerability identification program must mature as disclosure volumes climb and AI tools speed up discovery.
The CVE Program: Establishing a Quality Era Framework document, published on September 22, says the program is moving from a growth period into a new era focused on reliability, responsiveness and vulnerability data quality.
As of September 18, more than 67,000 CVEs had been published in 2026, and CVEForecast.org projects 96,000 by year-end.
The National Vulnerability Database (NVD) reported a 263% increase in CVE submissions between 2020 and 2025, and first-quarter submissions in 2026 were a third higher than a year earlier.
Faster Discovery Exposes Uneven Records
CISA said automated and AI-enabled tools add pressure across the software lifecycle, from development to disclosure, while rising volumes strain triage, coordinated vulnerability disclosure and CVE assignment.
Faster reporting makes vulnerability information more valuable when records are complete and actionable, CISA noted in the paper. However, the same acceleration exposes gaps in processes and accountability, especially when the quality of submissions is uneven.
"We are seeing a fundamental change in the economics of vulnerability research," said Russel Van Tuyl, vice president of security services at SpecterOps. He added that frontier AI is helping researchers find and validate exploit chains faster.
Van Tuyl said CISA's framework recognized "that better vulnerability data and faster coordination must accompany faster discovery."
CISA itself called the CVE Program an “essential public good” that must remain reliable in a high-volume, AI-accelerated environment.
Four Dimensions, No Targets Yet
The framework defines quality across four dimensions: program governance, ecosystem participation, data infrastructure and CVE record content.
The agency said each reinforces the others and none alone can deliver what it wants.
Proposed measures include how quickly governance decisions are made, conflicts of interest identified and resolved, the number and diversity of active CVE Numbering Authorities (CNAs), system uptime and API performance.
For the records themselves, the paper lists the share meeting defined quality criteria and how often records need correcting after publication. It presents these as potential measures and sets no targets or deadlines for them.
The dimensions map onto six lines of effort from CISA's existing CVE quality strategy, covering community partnerships, government sponsorship, modernization, transparency, data quality and the program's CNA of Last Resort.
Technical modernization can make the program more consistent and scalable, CISA said, but cannot replace community engagement, governance maturation or shared expectations for vulnerability data.
A blog series on cve.org in the coming months will detail infrastructure and data modernization work, and CISA said it will keep engaging CNAs, researchers, suppliers and downstream data consumers.