CISA outlines improvement plan for CVE program

The Cybersecurity and Infrastructure Security Agency published a white paper outlining a plan to improve the Common Vulnerabilities and Exposures (CVE) program, which has recently undergone significant growth. The agency is committed to leading and sustaining the CVE program by fostering stronger participation and governance within the community, informed by feedback from the CVE community.
The CVE program has experienced rapid expansion, with over 67,000 new CVEs published in 2026, and the National Institute of Standards and Technology's vulnerability database saw a 263% increase in submissions between 2020 and 2025, further accelerated by artificial intelligence. This rapid acceleration presents quality challenges across the ecosystem, as faster reporting can expose gaps in processes, tooling, coordination, and accountability if submission quality is uneven.
The improvement plan calls for advancing data quality across four dimensions: transparent governance, broad participation, data infrastructure, and reliable CVE record content. Experts have weighed in on this plan; some experts support CISA's goals but remain skeptical about the implementation details of the framework itself. Concerns exist regarding whether external organizations should assume stewardship given agency budget constraints. Furthermore, a critical issue highlighted is the lack of machine-readable software identifiers in many new CVE records, which experts argue must be addressed alongside quality metrics.

* The Cybersecurity and Infrastructure Security Agency published a paper detailing a plan to improve the Common Vulnerabilities and Exposures (CVE) program.
* The plan outlines components for a “Quality Era” for the program.
* CISA remains committed to leading, growing, and sustaining the CVE Program.
* Over 67,000 new CVEs were published in 2026.
* The National Institute of Standards and Technology's National Vulnerability Database program saw a 263% increase in CVE submissions between 2020 and 2025.
* Artificial intelligence has furthered the rise in CVE activity.
* Faster discovery can improve value if records are complete, consistent, timely, and actionable.
* Acceleration can expose gaps in processes, tooling, coordination, and accountability due to uneven submission quality.
* The plan calls for advancing data quality across four dimensions: transparent governance, broad participation, data infrastructure, and reliable CVE record content.
* Some CVE experts noted that incomplete or inconsistent records create downstream work for security tools and organizations.
* Tom Alrich stated the white paper ignores the issue of many new CVE records lacking a machine-readable software identifier.

The narrative presented frames the evolution of the CVE program as a transition from a "Growth Era" characterized by rapid expansion to a necessary "Quality Era" focused on structural maturation. This progression is driven by an external pressure—the accelerating volume and speed of vulnerability reporting, exacerbated by AI integration. The core tension lies between the immediate benefit of faster information dissemination and the long-term requirement for foundational systemic quality.
The skepticism voiced by experts highlights a critical disconnect: while the stated goal addresses quality across governance and infrastructure, there is a recognized gap regarding the most fundamental data element—the machine-readable identifier. This suggests that efforts to mandate higher-level frameworks may overlook the necessity of resolving granular, technical standards first. The shift implies that true security advancement depends not just on reporting more vulnerabilities, but on establishing verifiable, standardized systems for recording them.
The underlying pattern suggests a recurring friction point in large-scale technical governance: the difficulty in aligning operational velocity with necessary foundational consensus. When growth outpaces the ability to establish agreed-upon data standards, processes risk becoming brittle or misleading. The focus shifts from simply increasing quantity of reports (the Growth Era) to ensuring the integrity and utility of those reports (the Quality Era). The implication for agency stewardship is that true leadership requires addressing both high-level policy goals and low-level technical consistency simultaneously.
Bridge Questions: If quality improvements are dependent on current metrics, what specific mechanisms can be deployed immediately to enforce the data infrastructure component without waiting for the full framework iteration? How can the community effectively bridge the gap between abstract governance goals and concrete, actionable technical standards for identifiers like PURL? What incentives would shift stakeholders from prioritizing speed over completeness in CVE submission?