- CISA has published a white paper on raising the quality of records in the CVE vulnerability program, CyberScoop reported on September 24, as more than 67,000 new CVEs were published in 2026.
- Experts quoted by CyberScoop welcome the aims but say gaps remain, such as many new records lacking a machine-readable software identifier and quality metrics that are not shared publicly.
- WebPulse's view: because quality data is not public, users should ask how tools match CVEs to their software, who fixes flawed records, and what suppliers can show.
What CISA's white paper sets out
CISA has released a white paper on how it plans to raise the quality of records in the Common Vulnerabilities and Exposures (CVE) program, CyberScoop reported on September 24. CyberScoop describes the program as a widely used central reference for vulnerability data, and says its contract was nearly lost last year.
The report gives two volume figures. More than 67,000 new CVEs had been published in 2026 as of the week before publication, and submissions to NIST's National Vulnerability Database rose 263% between 2020 and 2025. The periods and measures differ, so they are not a single trend line. The report says CISA calls the program's history so far a "Growth Era", and the paper sets out the components of a "Quality Era."
What CISA commits to
Four areas anchor the plan: governance, community participation, supporting data infrastructure and record content that can be relied on. Chris Butera, CISA's acting executive assistant director for cybersecurity, said the agency "remains committed to leading, growing and sustaining" the program, and described the paper as an effort to support "stronger participation and governance."
The paper says faster discovery and reporting improves the value of vulnerability information when records are "complete, consistent, timely, and actionable." Where submission quality is uneven, it warns, the same speed can expose "gaps in processes, tooling, coordination, and accountability."
The AI link comes from CyberScoop, not from the passage of the paper it quotes. CyberScoop says artificial intelligence has furthered the rise in volume. Reading the two together is WebPulse's interpretation: where AI contributes to higher volume and submission quality is uneven, the gaps the paper describes matter more to organisations that depend on the records.
Three experts, three reactions
Brian Fox, Sonatype's co-founder and chief technology officer, welcomed CISA's recognition that quality reaches past individual records into governance, infrastructure and participation. He said the industry has worked around CVE quality problems for decades, and that records with gaps or contradictions create follow-on work for the tools, developers and organisations trying to work out whether they are affected. He will accept a "Quality Era" when improvement is visible in the data and in the decisions it enables.
Tom Alrich leads OWASP's PURL Expansion Working Group, which is developing a way to create Product URLs for commercial software. He supports the paper's aims but argues it leaves untouched what he considers the program's biggest problem: a large and rising share of new CVE records carry no machine-readable software identifier. On the paper's effect on that gap, he said "nothing in there" will change it.
Caitlin Condon, VulnCheck's vice president of security research, called CISA and the program well placed to set and enforce standards for what quality means in CVE records. She described the paper as the basis for a future framework rather than a finished one. Many of the metrics it suggests, she said, can be measured today but are not shared publicly, and she asked for more transparency in later versions. Because those metrics are not public, consumers have limited visibility into whether quality is improving.
CyberScoop adds that budget cuts at CISA have led some vulnerability experts to ask whether another organisation should steward the program. Butera has invited further feedback from the CVE community.
What to ask your team
WebPulse's view is that, with limited public visibility into quality metrics, the checking of CVE data falls in practice to the organisations that use it. Four questions follow. First, how does our vulnerability tooling link CVE records to our software inventory, and how many records affecting our stack arrive without a machine-readable identifier? Second, when records have gaps or contradictions, who does the manual work, and how many hours does it take? Third, which record-quality measures can our vulnerability-data suppliers show us today? Fourth, how far do our processes depend on CVE program records alone, and what is our plan if stewardship of the program changes?
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: CyberScoop.
