#CVE — insecure by design

info1 source

CISA Outlines Four-Pillar Quality Roadmap to Tackle Mounting CVE Backlog and Enrichment Deficits

The U.S. Cybersecurity and Infrastructure Security Agency released a four-page whitepaper targeting the future of the Common Vulnerabilities and Exposures framework. As vulnerability discoveries surge under AI-assisted research workflows, annual projections estimate that roughly 96,000 CVE identifiers will be cataloged within a single year. This influx represents nearly a quarter of all historical identifiers recorded across the ecosystem since the program debuted in September 1999. In response, CISA detailed four specific dimensions of quality to overhaul tracking reliability: program governance, ecosystem participation, data infrastructure, and CVE record content. Industry researchers note the strategic shift comes after years of uncertainty stemming from federal contract turbulence with Mitre and subsequent agency budget reductions. The vulnerability ecosystem remains heavily stressed by an enrichment bottleneck where approximately only one in five disclosures receives baseline metadata such as standard scoring attributes. Critics highlight that the document provides high-level aspirations rather than concrete operational mechanics to resolve unenriched CVE queues. Furthermore, the growth of decentralized numbering and enrichment authorities creates significant data friction, often yielding conflicting base scoring values across disparate regional and vendor registries.

medium1 source

CVSS v4.0 Exploit Maturity Metrics Are Leading to Artificially Deflated Vulnerability Scores

The CVSS version 4.0 framework introduced by the Forum of Incident Response and Security Teams is shifting how vulnerability severity gets measured across the industry. Under this standard, vendors assign a base severity score representing the technical ceiling of a flaw, which is subsequently adjusted using dynamic threat metrics like exploit maturity. When a vulnerability has no known active exploitation or public proof-of-concept, the calculated threat-adjusted score drops significantly below the base technical score. Security leaders note that this design aims to give vulnerability management teams a standardized method to de-prioritize bugs that currently lack weaponized tooling. However, researcher Kevin Beaumont highlighted that vendors serving as CVE Numbering Authorities, including major players like Cisco, Microsoft, and Palo Alto Networks, can define consumer-oriented threat metrics during initial disclosure. By tagging exploit maturity as 'Unreported' rather than leaving it 'Not Defined'—which historically assumed worst-case conditions—vendors can effectively prevent critical unauthenticated remote code execution bugs from scoring above an 8.0. This structural shift risks misclassifying critical flaws as mere high-severity items on disclosure day, creating blind spots for operational patching workflows. Practitioners warn that vendors rarely return to update these CVSS threat vectors once weaponized exploits surface publicly, leaving downstream organizations with deflated scores unless internal teams continuously re-evaluate external intelligence against their assets.