Changes to CVE program are a call to action on your AppSec strategy

The report outlines recent turbulence in the global vulnerability management ecosystem: NIST is deferring enrichment for pre-2018 CVEs in the NVD, while CISA extended MITRE’s CVE program contract for 11 months amid uncertainty about long-term stewardship. Experts urge organizations to shift from a purely vulnerability-centric posture to risk-based and proactive software supply chain security, emphasizing binary analysis, reproducible builds, hardening, and segmentation of legacy systems. New initiatives, including the CVE Foundation, ENISA’s EU Vulnerability Database, and CIRCL’s GCVE system, signal potential changes in governance and scalability for CVE identifiers while underscoring the ongoing need for standardized, high-quality vulnerability tracking.