CISA has set out a framework for improving the quality of CVE data, arguing that the vulnerability identification program must mature as disclosure volumes climb and AI tools speed up discovery.
The CVE Program: Establishing a Quality Era Framework document, published on September 22, says the program is moving from a growth period into a new era focused on reliability, responsiveness and vulnerability data quality.
As of September 18, more than 67,000 CVEs had been published in 2026, and CVEForecast.org projects 96,000 by year-end.
The National Vulnerability Database (NVD) reported a 263% increase in CVE submissions between 2020 and 2025, and first-quarter submissions in 2026 were a third higher than a year earlier.
Faster Discovery Exposes Uneven Records
CISA said automated and AI-enabled tools add pressure across the software lifecycle, from development to disclosure, while rising volumes strain triage, coordinated vulnerability disclosure and CVE assignment.
Faster reporting makes vulnerability information more valuable when records are complete and actionable, CISA noted in the paper. However, the same acceleration exposes gaps in processes and accountability, especially when the quality of submissions is uneven.
“We are seeing a fundamental change in the economics of vulnerability research,” said Russel Van Tuyl, vice president of security services at SpecterOps. He added that frontier AI is helping researchers find and validate exploit chains faster.
Van Tuyl said CISA’s framework recognized “that better vulnerability data and faster coordination must accompany faster discovery.”
CISA itself called the CVE Program an “essential public good” that must remain reliable in a high-volume, AI-accelerated environment.
Read more on vulnerability disclosure: CISA Upgrades Vulnerability Reporting Platform with More Automation
Four Dimensions, No Targets Yet
The framework defines quality across four dimensions: program governance, ecosystem participation, data infrastructure and CVE record content.
The agency said each reinforces the others and none alone can deliver what it wants.
Proposed measures include how quickly governance decisions are made, conflicts of interest identified and resolved, the number and diversity of active CVE Numbering Authorities (CNAs), system uptime and API performance.
For the records themselves, the paper lists the share meeting defined quality criteria and how often records need correcting after publication. It presents these as potential measures and sets no targets or deadlines for them.
The dimensions map onto six lines of effort from CISA’s existing CVE quality strategy, covering community partnerships, government sponsorship, modernization, transparency, data quality and the program’s CNA of Last Resort.
Technical modernization can make the program more consistent and scalable, CISA said, but cannot replace community engagement, governance maturation or shared expectations for vulnerability data.
A blog series on cve.org in the coming months will detail infrastructure and data modernization work, and CISA said it will keep engaging CNAs, researchers, suppliers and downstream data consumers.
