CISA: CVE Program to Focus on Vulnerability Data Quality

According to CISA, the CVE Program should move into a new era focused on trust, responsiveness and vulnerability data quality, with expanded partnerships and transparency as its core aims. The programme, which turned 25 last year, has seen CNAs grow to over 460 as of 2025, and is now prioritising diversification of international partnerships and ongoing government investment, mainly from CISA.

CISA says the vision includes modernising CVE infrastructure through automation and other capabilities to improve visibility, responsiveness and data enrichment, while implementing minimum standards for CVE Record quality and scaling enrichment mechanisms. The CVE Program should remain a public good, with conflict-free, vendor-neutral stewardship and global participation in governance, and data must remain free and openly accessible to downstream users.

As part of the drive, executives such as Nick Andersen emphasised that the program will be well-governed, trusted and responsive, aiming to enhance the quality of vulnerability data and global cybersecurity resilience. Written by Ionut Arghire, September 12, 2025.