The U.S. Cybersecurity and Infrastructure Security Agency (CISA)
published a new paper outlining its framework for improving CVE program quality amidst growing vulnerability volumes driven in part by AI advancements.
The paper outlines four key dimensions that define the program’s quality, each with their own success metrics and connections to six strategic lines of effort CISA defined when it
outlined its CVE program strategy last year.
The agency stated that the CVE program has reached an “inflection point” and that the framework is designed to support the program’s reliability and success as it transitions from the past decade’s “Growth Era” to its modern-day “Quality Era.”
As highlighted in the paper, CVE volume has increased significantly since 2020 and within the last year, with a 263% increase in CVE submissions recorded between 2020 and 2025 and the first quarter of 2026 seeing roughly 33% more submissions than the first quarter of 2025.
In total, more than 67,000 new CVEs have been published in 2026 as of Sept. 18, with that number projected to reach about 96,000 by the end of the year, according to
CVEForecast.org. Advanced AI models capable of vulnerability discovery, such as Anthropic’s Claude Mythos, have contributed to the
accelerated pace of vulnerability reports.
“These pressures intensify quality challenges across the CVE ecosystem. While faster discovery and reporting can improve the value of vulnerability information when records are complete, consistent, timely, and actionable, the same acceleration can expose gaps in processes, tooling, coordination, and accountability — especially when the quality of the submissions is uneven,” the whitepaper stated.
Matt Hartman, chief strategy officer at Merlin Group, told SC Media quality, consistency and speed will be key factors in maintaining the program’s value amidst a flood of new submissions.
“As AI accelerates vulnerability discovery, practitioners need accurate, timely information to prioritize action. A CVE ID tells you a flaw exists; defenders need to know whether it’s exploitable, whether it’s being exploited, and what it affects. CISA’s framework is a meaningful step toward that,” Hartman said.
4 dimensions to define CVE program quality
The core of the new framework lies in four dimensions outlined by CISA, which provide areas of focus and success metrics for measuring progress. These dimensions — program governance, ecosystem participation, data infrastructure and CVE record content — are designed to complement CISA’s six strategic lines of effort outlined last year: expansion of community partnerships, government sponsorship, modernization, transparency and communication, data quality improvements and improvements in CVE Number Authorities of Last Resort (CNA-LRs).
Program governance focuses on establishing clear stewardship, maturing organization structure, supporting collaborative decision-making and ensuring representative participation across the CVE ecosystem. Success metrics include the timeliness of governance decisions and frequency of publications such as policies and updates, the number of conflicts of interest identified and resolved and external satisfaction and trust measured from sources such as partner surveys.
Ecosystem participation is measured by the number and diversity of active CNAs, Roots and CNA-LRs, participation rates among working groups and community events, the volume and quality of community feedback and the growth rate of participating organizations across different sectors and regions.
“CISA is right to focus on quality and trust, which requires transparent governance and broad participation across government, industry, and the security research community,” Hartman said.
Data infrastructure is defined as the systems that support the CVE program’s core operational functions, such as CVE ID reservation and records publication, which includes APIs, schemas, validation libraries and the cve.org website. System uptime and reliability, API performance and throughput, validation error frequency and time to deploy schema and platform updates are noted as key success metrics.
Lastly, the CVE record content dimension focuses on ensuring complete, accurate, timely and actionable CVE records for defenders measured by the percentage of CVE records that meet defined quality criteria and the rate of corrections and updates made to records after publication.
“These dimensions reinforce one another. Technical modernization can strengthen consistency and scalability, but it cannot replace community engagement, governance maturation, or shared expectations for vulnerability data,” the paper stated. “Similarly, stronger participation and governance create the foundation for organizations across the ecosystem to adopt technical improvements effectively.”
The whitepaper also maps relationships between the four quality dimensions and six strategic lines of effort; for example, the framework’s focus on data infrastructure overlaps with government sponsorship, modernization and CNA-LR improvement efforts.
CISA commits to CVE leadership despite challenges
This latest framework follows up on CISA’s strategic focus document published in September 2025, a few months after CISA exercised an option period on its contract with MITRE to continue funding the CVE program
just a day before the contract was set to expire. The preceding uncertainty about the program’s funding led some to question whether an alternative to government sponsorship was needed to sustain the critical resource.
CISA’s strategy paper rejected the prospect of funding the CVE program through the private sector, saying this would “dilute its value as a public good,” and emphasized the importance of the program’s transparency and global participation in its governance while noting that it would consider “potential mechanisms for diversified funding” as part of its sponsorship efforts.
“CISA remains committed to leading, growing and sustaining the CVE Program into the foreseeable future, just as we’ve done for more than 25 years without fail. Our close collaboration with global industry and government partners is the primary reason the CVE Program remains a trusted, useful source,” CISA’s Acting Executive Assistant Director for Cybersecurity Chris Butera said in a statement Wednesday.
CISA also saw significant
workforce and budget cuts in 2025, with reported layoffs of more than a thousand staff members and funding cuts of nearly $500 million, although Acting Director Nicholas Andersen has said the agency remains highly functional and committed to its priorities despite the reductions.
Earlier this month, Andersen said the agency was preparing to onboard 250 new prospective employees pending final clearance,
as reported by Nextgov.
