The CVE Program Quality Era: Strengthening Trust and Impact In Global Vulnerability Data

The CVE Program Quality Era: Strengthening Trust and Impact In Global Vulnerability Data

Speakers: Lindsey Cerkovnik (Branch Chief of Vulnerability Response and Coordination, CISA); Alec Summers (CVE and CWE Project Lead, The MITRE Corporation)

Conference: VulnCon

YouTube: https://www.youtube.com/watch?v=ci5a19peUag

Overview

In an insightful and forward-looking presentation at VulnCon, Lindsey Cerkovnik from CISA and Alec Summers from The MITRE Corporation unveiled the strategic direction for the Common Vulnerabilities and Exposures (CVE) Program, heralding what they term the "Quality Era." This pivotal talk addressed the critical need for the CVE Program to evolve beyond its successful scaling efforts to focus intensely on the quality, trustworthiness, and actionability of vulnerability data. The speakers emphasized that quality is a multifaceted concept, encompassing not just the individual CVE record but also the underlying infrastructure, the breadth and consistency of participant engagement, and the efficacy of the program's governance.

The core message of the presentation revolved around the CVE Program's inherent capacity for evolution, asserting that "there's nothing inherently wrong with the CVE program that can't be resolved by the CVE program." This confident stance underscores a community-driven approach to addressing current challenges and preparing for future demands. Cerkovnik and Summers detailed ambitious plans to enhance data quality, streamline operational processes, foster broader and more diverse participation, and mature the program's governance structure. Their vision aims to ensure that CVE remains the indispensable global standard for vulnerability identification, empowering defenders and product creators alike to build and maintain secure systems in an increasingly complex threat landscape.

This shift to the Quality Era is not merely an incremental adjustment but a strategic imperative driven by the program's immense growth and the escalating sophistication of the vulnerability ecosystem. By proactively tackling issues such as record completeness, data validation, and stakeholder representation, the CVE Program seeks to reinforce its foundational role in global cybersecurity. The talk served as a comprehensive roadmap for how the program intends to meet these challenges, inviting continued collaboration from the community to collectively strengthen the trust and impact of CVE data worldwide.

Background

▶ Watch: Defining CVE program quality as multifaceted and evolving (2:19)

The CVE Program, initiated in 1999, emerged from a fundamental need to standardize the identification of vulnerabilities. Prior to CVE, the cybersecurity community lacked a common lexicon, leading to significant inefficiencies where different tools and individuals would refer to the same vulnerability using disparate terms. This "proof of value" era established CVE as a crucial concept, enabling consistent communication and reducing wasted time in defensive operations.

As the digital landscape expanded and the volume of discovered vulnerabilities surged, the program entered its "scaling era" around the mid-2000s. It became clear that a single organization, MITRE, could not indefinitely manage the assignment and publication of CVEs for the entire global ecosystem. This realization spurred a significant drive towards federation, encouraging CNA (CVE Numbering Authority) participation. The strategy was to empower organizations closest to the products—typically vendors—to take on the responsibility of identifying and publishing CVEs, leveraging their intimate knowledge of their own offerings. This initiative led to a massive increase in CNA participation and program coverage, ensuring that a broader range of vulnerabilities received CVE identifiers.

However, the success of scaling introduced new challenges, primarily concerning data quality. With a rapidly expanding and diverse CNA community, inconsistencies in record completeness, accuracy, and the provision of actionable information became more apparent. Downstream consumers—defenders, researchers, and security tools—increasingly demanded richer, more structured data than the minimal requirements initially set for a CVE record (ID, description, reference, and applicable product). This growing disparity between demand and supply of high-quality, actionable vulnerability data highlighted the need for another evolutionary leap, marking the transition into the current Quality Era. This new phase aims to address the inherent quality issues that arose from successful scaling, ensuring that the sheer volume of CVEs is matched by their utility and trustworthiness.

Key Findings

▶ Watch: Establishing new expectations for CVE record completeness (12:55)

The talk outlined several critical findings and strategic shifts underpinning the CVE Program's Quality Era:

• Multifaceted Definition of Quality: Quality within the CVE Program extends far beyond individual record completeness. It encompasses the entire ecosystem, from the data within a record (micro perspective) to the supporting infrastructure, consistent participation by CNAs, and effective governance (macro perspective). All these layers must function synergistically to provide trustworthy and actionable vulnerability information.
• CVE Program at an Inflection Point: The program is undergoing a healthy evolution, moving from a "proof of value" to a "scaling era," and now into a "quality era." This transition is necessary to address the challenges born from the success of scaling and to prepare for future demands.
• Need for Enhanced Record Requirements: While only a few fields are technically required for a CVE record (ID, description, reference, product), there is significant community demand for more comprehensive, structured data. This includes CVSS (Common Vulnerability Scoring System) scores (beyond just base scores), CWE (Common Weakness Enumeration) root cause mappings, PURL (Package URL) strings, CPE (Common Platform Enumeration), and critically, structured remediation information. The program intends to establish new baseline expectations for these fields to improve overall record utility.
• Successful Federation of CVE Assignment: The growth in CNA participation has significantly decentralized CVE assignment. In 2016, 100% of CVEs were assigned by the CNA LR (CNA of Last Resort) (MITRE/CISA). By 2025, this dropped to 11%, and in 2026, it's projected to be as low as 7%. This demonstrates the successful distribution of workload, enabling the program to scale.
• Underrepresentation in the Ecosystem: While the program has grown globally (41 countries, 500+ CNAs), certain critical sectors remain underrepresented. These include open source projects, critical infrastructure entities, cyber-physical systems, hardware/embedded systems, and cloud/hosted services. Addressing this requires targeted outreach and support to ensure diverse representation and perspectives in the program.
• Governance Maturation is Essential: The current governance structure, designed for a smaller program, needs re-examination. Key areas for improvement include clarifying decision-making authority, establishing clear expectations for participants, ensuring transparent stewardship, fostering a representative ecosystem, achieving structural maturation, and promoting conflict-free participation (meaning free of conflicts of interest).
• Emerging Challenges from Rapid Technological Change: The vulnerability landscape is not static, with early signals of rapid structural change driven by new technologies, including automated vulnerability discovery. These changes magnify existing pressures on timelines and the completeness of vulnerability information, requiring the CVE Program to adapt its quality standards and collaborative approaches.
• Phased Approach to Quality Improvement: The program is adopting a three-phase strategy: establishing a baseline (defining record quality, infrastructure development), scaling improvements across the ecosystem (tool launches, CNA support), and optimizing through continuous feedback.

Technical Deep Dive

▶ Watch: Key data infrastructure and tooling enhancements underway (16:09)

The CVE Program's commitment to the Quality Era is significantly bolstered by a series of technical advancements and infrastructure enhancements designed to meet evolving demands. These initiatives target several key pillars:

Data Infrastructure Enhancements

The program is advancing its core CVE services to address critical pain points and enable richer data.

• Reference Archiving Support: A major effort within the Automation Working Group is focused on ensuring the permanence of references within CVE records. This aims to create snapshots of public references at the time of publication, preventing link rot and preserving the historical context of vulnerabilities for perpetuity. This is crucial for defenders who rely on these references for detailed analysis.
• Schema Requirements Library: The Quality Working Group is developing a comprehensive library of data quality expectations for various elements within the CVE record schema. This formalized approach will enable CVE services to enforce consistent data input and validation, ensuring that information like CWE mappings or product types meet defined standards. For instance, it will prevent a CNA from entering "CWE 77" and then providing a description that contradicts that classification.
• Organizational Identity and Management Service (Data Registry): To alleviate administrative burdens for CNAs, a new Data Registry is being rolled out. This service will allow CNAs to directly manage their organizational information, including personnel changes, without relying on slow, methodical processes involving the secretariat. Beyond basic housekeeping, this capability could facilitate more direct and scalable data sharing across the CVE program.
• Evolving Record Format: The program is actively exploring the formal inclusion of more structured data fields in CVE records. A top request from the community, identified through a CVE program survey, is structured remediation information. This would move remediation details from being buried in descriptions or advisories into a machine-readable and human-actionable format directly within the CVE record. Other additions include support for PURL strings and enhanced CPE information, providing more precise software identification.
• Downstream Data Consumer Pull: Efforts are underway to explore new, more direct ways for downstream data consumers to pull information from CVE, moving beyond existing methods to improve efficiency and accessibility for automated systems.
• CVE Program-Coupled JSON Generation Client: Recognizing a potential disconnect between schema advancements and the availability of open-source tools for generating CVE JSON, the program is exploring creating its own tightly coupled client. This would ensure that as the schema evolves, a program-supported tool is immediately available, reducing delays and ensuring compliance.

CNA LR Tech Stack and Web Form Upgrade

A significant overhaul is underway for the web form system, cveform.mitre.org, which is used by non-CNA suppliers, maintainers, and researchers to obtain IDs and publish records through the MITRE CNA LR. The current system is acknowledged as outdated and limited, prompting the development of a purpose-built upgrade.

The new system, which began a closed beta in March and targets a May 19th rollout, introduces several key features:

• Real-time Visibility: Users will gain real-time visibility into the status of their ID requests, moving away from a "black box" process. This includes tracking submission status, who has viewed it, and any actions taken.
• Self-Service Updates: Researchers will no longer need to send emails with ticket numbers to update their requests. The new platform will allow them to directly modify and add information to their submissions as details evolve.
• Comprehensive Data Input: The system will enable researchers and suppliers to provide all information associated with the full CVE record schema. This includes detailed CVSS scores (beyond just base), CWE mappings, and extensive software identifiers and affected products. An anecdote from the beta highlighted a user adding 75 affected products directly through the tool, significantly enriching the record at the time of publication.
• Verified Domain Ownership: For product suppliers who are not CNAs but wish to contribute vulnerability disclosures, the system will offer a capability for verified domain ownership. This allows records published via the MITRE CNA LR to be attributed "on behalf of" the specific product owner, enhancing transparency and trust.
• Faster Response Times: The enhanced workflows and backend efficiencies are expected to significantly reduce response times from the MITRE team.
• Fishing-Resistant Multi-Factor Authentication: The new system will incorporate robust security measures, including fishing-resistant multi-factor authentication, to protect user accounts and sensitive vulnerability information.

This comprehensive technical upgrade aims to make the process of submitting and managing CVE requests more transparent, efficient, and user-friendly, directly supporting the Quality Era's goals by facilitating the submission of richer, more complete data.

Demo / Proof of Concept

▶ Watch: Re-examining program governance and Federation 2.0 strategy (40:20)

While no live, interactive demonstration was conducted during the talk, the speakers effectively presented a "proof of concept" through the description of the new CNA LR web form system and its ongoing beta. Alec Summers explicitly referenced a "screenshot here" and a "timeline" for the rollout, illustrating the user interface and the development progress.

The core of this demonstration was the detailed explanation of the new system's capabilities, which directly address long-standing pain points for researchers and non-CNA suppliers:

• Real-time Visibility: The new system moves beyond the "black box" of the old cveform.mitre.org. Users will be able to log in and see the current status of their ID requests, track progress, and understand where their submission is in the workflow. This was described as a significant improvement over waiting for email updates.
• Self-Service Updates: A key feature demonstrated was the ability for users to update their own vulnerability submissions. Instead of sending emails to the MITRE team, users can directly add or modify information, ensuring records are as complete as possible.
• Comprehensive Data Input: The system is designed to allow submitters to provide a full complement of CVE record schema information, including detailed product and version data, CVSS scores, and CWE mappings. This was highlighted with a specific anecdote from the beta program: "somebody who's been sort of an early adopter in this in this beta... had demonstrated... to add 75 affected products in the tool itself, so that when the record is published, it's all going to be there." This real-world example from the beta directly validated the system's ability to facilitate richer data input.
• Verified Domain Ownership: The concept of verified domain ownership was also presented as a new capability, allowing non-CNA product owners to have their CVEs published with clear attribution, even when processed through the MITRE CNA LR.

The timeline indicated a closed beta started in March and a public rollout targeted for May 19th, with the old form remaining available for a transition period before a hard cutover later in the year. This phased deployment, coupled with the detailed feature breakdown and beta user feedback, served as a compelling demonstration of the program's commitment to tangible technical improvements in the Quality Era.

Defensive Implications

▶ Watch: CISA's stance: CVE as a public good under public stewardship (59:00)

The CVE Program's shift to the Quality Era carries profound implications for defenders, offering opportunities for more effective vulnerability management and response:

• Richer, More Actionable CVE Records: The push for standardized, required fields beyond the basics—such as comprehensive CVSS scores, CWE root causes, PURL strings, CPE identifiers, and especially structured remediation information—will significantly enhance the utility of CVEs. Defenders can leverage this enriched data for more accurate risk assessment, automated triage, and precise prioritization of patches and mitigations. This reduces the manual effort often required to gather missing context.
• Improved Data Reliability and Persistence: The initiative for reference archiving support directly addresses the problem of link rot, ensuring that the contextual information behind a CVE remains accessible over time. This means defenders will have more reliable access to original advisories and vulnerability details, which is crucial for incident response and long-term asset management.
• Greater Transparency and Efficiency in Disclosure: The upgraded CNA LR system, with its real-time visibility and self-service update capabilities, promises faster ID assignment and more dynamic information updates. This could lead to quicker public disclosure of vulnerabilities with more complete data, allowing defenders to react more promptly. The ability for non-CNA product owners to publish "on behalf of" their domain also fosters greater transparency in the disclosure ecosystem.
• Leveraging Federated Assignment: While the decentralization of CVE assignment means MITRE/CISA publish fewer records, the overall volume of CVEs is projected to increase significantly (60,000-70,000 projected for the current year). Defenders must ensure their vulnerability management tools and processes are robust enough to consume and process data from a diverse array of CNAs, each potentially using slightly different styles or levels of detail, even with new quality standards.
• Engagement Opportunities: The program explicitly invites community participation in working groups like the Quality Working Group and the Automation Working Group. Defenders have a direct avenue to influence the definition of future CVE record requirements, data validation standards, and tooling development, ensuring that the program evolves in a way that best serves their needs.
• Preparation for Emerging Threats: The recognition of "rapid structural train change driven by new technologies" (e.g., AI-driven vulnerability discovery) signals that defenders should anticipate an increased volume and complexity of vulnerabilities. The CVE Program's focus on quality and automation aims to provide a resilient foundation for managing this future, but defenders must also adapt their internal systems and strategies to consume and act upon this data at scale.
• Understanding Program Governance: Defenders should be aware of the ongoing efforts to mature CVE program governance, as a more transparent, representative, and efficient governance structure will ultimately lead to a more stable and responsive vulnerability ecosystem. This includes ensuring that the program remains a public good with neutral stewardship, which is vital for maintaining trust across all stakeholders.

In essence, the Quality Era promises a CVE Program that is not just bigger, but better—providing higher-fidelity, more actionable intelligence that defenders can integrate into their security operations to make more informed and timely decisions.

Key Takeaways

• The CVE Program is actively transitioning into a "Quality Era," acknowledging that successful scaling necessitates a renewed focus on the trustworthiness and actionability of vulnerability data across all program dimensions: data, infrastructure, participation, and governance.
• New requirements and technical tooling are being developed to enrich CVE records with more structured and actionable information, including comprehensive CVSS scores, CWE mappings, PURL strings, CPE identifiers, and critically, structured remediation information, moving beyond minimal requirements.
• The upgraded CNA LR web request system, with a public rollout targeted for May 19th, will provide researchers and non-CNA suppliers with real-time visibility into requests, self-service update capabilities, support for complete CVE record schema input, and verified domain ownership, significantly streamlining the submission process.
• The program's federation strategy has successfully distributed CVE assignment, with MITRE/CISA now responsible for a small percentage (7% in 2026, down from 100% in 2016), but the focus is now on strengthening support for the growing CNA community and expanding representation for underrepresented sectors like open source and critical infrastructure.
• Governance maturation is a priority, with CISA emphasizing the need for transparent stewardship, a representative ecosystem, structural maturation, and conflict-free participation to ensure the program's long-term resilience and effectiveness as a public good.
• The CVE Program recognizes and is proactively preparing for emerging challenges posed by a rapidly evolving vulnerability landscape, particularly those driven by new technologies like AI-driven vulnerability discovery, aiming to ensure quality standards meet the future scale and speed of disclosures.

About the Speaker(s)

Lindsey Cerkovnik is the Branch Chief of Vulnerability Response and Coordination at CISA (Cybersecurity and Infrastructure Security Agency). Her team is responsible for a wide array of critical functions, including scoring all new CVEs using SSVC (Stakeholder Specific Vulnerability Categorization) for triage to prioritize federal civilian executive branch agencies' response efforts. Additionally, her team manages coordinated vulnerability disclosure (CVD) on behalf of the federal government, handling approximately 250-300 cases concurrently, and oversees the Known Exploited Vulnerabilities (KEV) Catalog. Cerkovnik also serves as the sponsor, program manager, and an active participant in the CVE Program, working closely with MITRE.

Alec Summers is The MITRE Corporation's CVE and CWE Project Lead, bringing over a decade of experience within these critical programs. At MITRE, he leads a team responsible for operating a top-level root and its associated CNA LR, developing infrastructure to support the community, and providing secretariat functions. This includes program coordination across the entire CVE ecosystem and specifically onboarding and supporting CNAs within the MITRE root ecosystem. Summers is a key figure in guiding the technical and operational evolution of the CVE and CWE programs.