It remains an industry standard and when there is a vulnerability, security professionals often look at the Common Vulnerabilities and Exposures (CVE) to see where they stand.
But as the industry is evolving, so too, must the CVE program. That is where the Cybersecurity and Infrastructure Security Agency (CISA) comes in as it just released a white paper entitled, “CVE Program: Establishing a Quality Era Framework.”
The document introduces four dimensions of quality and explains how they align with the six lines of effort outlined in CISA’s “Strategic Focus on CVE Quality for a Cyber Secure Future,” published last year.
With new CVE Numbering Authorities and Roots joining the program from around the world, and automated and AI enabled technologies ramping up across the software development lifecycle, CISA recognized there needs to be a holistic maturation effort to transition the program to a new quality era.
This transition paves the way for the CVE Program to respond to the pressures and challenges facing the CVE ecosystem and to continue meeting the cybersecurity community’s needs through a refocused lens on reliability, responsiveness, and data quality.
To that end, as of September 18, over 67,000 new CVEs published in 2026 and VEForecast.org projects 96,000 new CVEs will publish by the end of the year. Additionally, the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) program reported a 263 percent increase in CVE submissions between 2020 and 2025, with submissions in the first three months of 2026 one third higher than during the same period in 2025.
The framework’s four dimensions include:
- Program governance which provides transparent and effective governance
- Ecosystem participation including broad, active, and global community representation
- Data infrastructure that is robust and supports core CVE operational functions
- CVE record content that cyber defenders and users can rely on with confidence.
Click here to read the complete white paper.