CISA plans CVE overhaul as vulnerability volume explodes

The Cybersecurity and Infrastructure Security Agency (CISA) has introduced a new framework aimed at improving the quality of Common Vulnerabilities and Exposures (CVE) data. This initiative is driven by the increasing volume of disclosed vulnerabilities and the accelerated discovery rates facilitated by AI tools, necessitating a more mature identification program, as first reported by Infosecurity Magazine.

The CVE Program: Establishing a Quality Era Framework document highlights the program's transition from a growth phase to an era prioritizing reliability, responsiveness, and data quality. With over 67,000 CVEs published by September 18, 2026, and projections of 96,000 by year-end, the National Vulnerability Database (NVD) has seen a significant increase in submissions. CISA acknowledges that automated and AI-enabled tools are speeding up vulnerability discovery and exploitation, placing strain on existing processes. The framework addresses this by defining quality across four dimensions: program governance, ecosystem participation, data infrastructure, and CVE record content. While CISA has outlined potential measures for these areas, specific targets and deadlines have not yet been set. The agency emphasizes that technical modernization alone is insufficient and must be complemented by community engagement and governance maturation to ensure the CVE program remains a reliable public good in an AI-accelerated environment.

Source: Infosecurity Magazine