CISA Launches Roadmap for the CVE Program – Source: www.infosecurity-magazine.com

In a new document, the US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed its support for the Common Vulnerabilities and Exposures (CVE) program.

The agency also outlined some of the future priorities for the program in what it calls its “Quality Era”.

CISA Evaluates Potential Mechanisms for Diversified CVE Funding

This CISA Strategic Focus document, called “CVE Quality for a Cyber Secure Future,” was published on September 10.

This is six months before CISA’s April 2025 decision to reportedly extend MITRE’s contract by 11 months, securing funding for the program through to March 2026.

The document calls for the CVE program to remain publicly maintained and vendor-neutral, emphasizing that privatizing it would “dilute its value as a public good.”

However, the agency acknowledged the need for a more active leadership role in the program as well as additional investment.

“Many in the community have requested that CISA consider alternative funding sources,” the agency added, assuring it is evaluating “potential mechanisms for diversified funding.”

On LinkedIn, Patrick Garrity, a vulnerability researcher at VulnCheck, noted the absence of any mention of MITRE in the document. “Could this signal an intention by CISA to assume the secretariat role in administering the program?” he asked.

Need for Broader Multi-Sector Engagement

The CISA Strategic Focus document also highlighted the need for broader, multi-sector engagement in the CVE program going forward, as well as transparent processes and accountability.

“The CVE Program advisory board should be a holistic representation of the ecosystem,” it said.

“CISA intends to leverage its partnerships to ensure better representation from international organizations and governments, academia, vulnerability tool providers, data consumers, security researchers, the operational technology (OT) industry and the open-source community,” the agency added, citing the Vulnrichment program as an example to follow.

Launched by CISA in May 2024, the Vulnrichment program has been critical in filling gaps left by the US National Vulnerability Database (NVD).

The NVD is a downstream vulnerability disclosure and enrichment program run within the US National Institute of Standards and Technology (NIST). It has also been experiencing funding and staffing issues for the past year and a half.

Some initiatives to broaden the scope of CVE contributors have already been launched by CISA, which opened new CVE forums and working groups in July 2025 – namely, the CVE Consumer Working Group (CWG) and the CVE Researcher Working Group (RWG).

Speaking on behalf of his company, VulnCheck, Garrity said on LinkedIn: “We’ve remained committed to helping improve the CVE Program through much broader participation including […] helping spin up the security researcher working group in collaboration with Tod Beardsley, Cisco Talos, Trend Micro’s Zero Day Initiative, GitHub and other security research CVE Numbering Authorities (CNAs)”.

CNAs are authorized organizations with a specific scope and responsibility to regularly assign CVE IDs and publish corresponding CVE records.

CVE Program’s Modernization Roadmap

Additionally, the CISA Strategic Focus document outlined some ambitions for modernizing the CVE program in the future, including for CNAs, CNAs of Last Resort – vetted organizations responsible for assigning CVE IDs and publish CVE records for vulnerabilities not covered by the scope of another CNA, and Authorized Data Publishers (ADPs) – organizations granted the right to enrich the records of existing vulnerabilities with data.

These ambitions include:

• Prioritizing more rapid implementation of automation and other capabilities, specifically improving CNA services, expanding API support to downstream data consumers and improving CVE.org
• Improving vulnerability data quality by implementing new minimum standards for CVE record quality and developing federated mechanisms to scale enrichment (e.g. Vulnrichment, the Authorized Data Publisher capability)
• Improving transparency, visibility responsiveness and data enrichment across CNA of Last Resort (LR)
• Seeking community feedback and incorporating it into program roadmap decisions
• Regularly communicating program milestones and performance metrics
• Actively engaging in dialogue with global partners

Speaking to Infosecurity, VulnCheck’s Garrity welcomed the document.

“It’s a starting point and highlights the need for reform across the program. There is a lot of opportunity for improvement that has largely gone neglected,” he said.

From “Growth Era” to “Quality Era”

The document also institutionalizes the divide between the CVE program’s past “Growth Era” and the upcoming “Quality Era.”

According to CISA, the CVE’s growth era is “characterized by the successful recruitment of an extensive worldwide network of more than 460 CVE Numbering Authorities (CNAs), [contributing] to exponential growth in the cybersecurity community’s capacity to identify, define and catalog hundreds of thousands of vulnerabilities.”

However, the program now needs to evolve to “meet the needs of this global cybersecurity community.” Therefore, it must transition into new focuses, specifically improving trust, responsiveness and vulnerability data quality.

This divide between the program’s growth and quality eras is not new.

In September 2024, Lindsey Cerkovnik, then brand chief of vulnerability response and coordination at CISA, used a similar terminology during the Fall 2024 Infosecurity Magazine Online Summit.

“We have to have automation built into the ecosystem to remediate faster. And we’ve continued to build that. We are now moving from the growth era to the quality era,” he told the Black Hat audience.