CISA publishes CVE Quality Era framework

Policy · 25 September 2026 · Source: Industrial Cyber

CISA launches CVE Quality Era framework to improve vulnerability data quality, infrastructure, program governance — Image: Industrial Cyber

CISA has published a framework for establishing the ‘Quality Era’ of the Common Vulnerabilities and Exposures (CVE) Program, setting out four areas of work: transparent governance, broad global participation, robust data infrastructure and high-quality CVE record content.

The agency said rising vulnerability volumes are straining triage, coordinated disclosure and CVE assignment. More than 67,000 new CVEs have been published so far in 2026, with CVEForecast.org projecting 96,000 by year end, while NIST’s National Vulnerability Database reported a 263% increase in submissions between 2020 and 2025.

The framework identifies six lines of effort, including community partnerships, government sponsorship, modernisation, transparency and communication, data quality improvements and expanded capacity for the CNA of Last Resort. CISA said it will publish a blog series on cve.org covering technology, infrastructure and data modernisation in the coming months.

Market intelligence, weekly