cyber.hendryadrian.com
Security News · therecord.media

CISA Opens KEV Nominations to External Vulnerability Researchers

· Original article ↗

Summary

CISA’s new nomination form lets external researchers, vendors, and industry partners submit exploited vulnerabilities with supporting evidence for possible inclusion in the KEV catalog, aiming to improve validation and speed defensive action.

Key points

  • Researchers, vendors, and industry partners can nominate exploited vulnerabilities through a new form or by email, providing information about the bug and evidence of exploitation.
  • CISA says the process will help it identify, validate, and share information about exploited vulnerabilities more quickly.
  • The KEV catalog guides remediation priorities; experts cited in the article found organizations remediate KEV-listed vulnerabilities 3.5 times faster than other bugs.
  • A Qualys expert said the form requires more detailed information, but questioned how CISA will verify submissions and prevent false reports.
  • The article notes that some KEV remediation deadlines have shortened to three days or 24 hours, amid concerns that AI could accelerate vulnerability discovery and exploitation.

Article Details

Event Type
CISA introduced a nomination form for researchers, vendors, and industry partners outside the U.S. government to submit evidence of exploited vulnerabilities for possible inclusion in the Known Exploited Vulnerabilities (KEV) catalog.
Impact
The process is intended to help CISA identify and validate exploitation reports and share threat information more quickly, supporting faster prioritization and remediation. The article reports that organizations remediate KEV-listed vulnerabilities 3.5 times faster than non-KEV vulnerabilities. Experts also raised questions about how CISA will verify submissions and prevent false or incorrect reports.

People

Chris ButeraCISA’s Acting Executive Assistant Director for Cybersecurity; described the new reporting capability as supporting identification, validation, and timely sharing of critical threat information.Chris DoyleJupiterOne representative who said improvements to the process could strengthen the KEV’s signal quality and timeliness for defenders.Mayuresh DaniQualys representative who commented on the new form’s reporting requirements and called for visibility into CISA’s verification process and safeguards against false reports.Nick AndersonCISA Acting Director who, according to Reuters as reported in the article, floated the possibility of shortening KEV remediation deadlines for new vulnerabilities.Robert CostelloFormer CISA chief information officer who commented that the nomination process could operationalize collaboration with the cybersecurity research community and speed defensive action.Sean CairncrossU.S. National Cyber Director who, according to Reuters as reported in the article, floated the possibility of shortening KEV remediation deadlines for new vulnerabilities.

Products

CISA Known Exploited Vulnerabilities (KEV) Cataloggovernment report vulnerabilities for possible inclusion in the Known Exploited Vulnerabilities catalog.

Countries

United StatesCISA has introduced a new nomination form that lets researchers, vendors, and industry partners outside the U.S.

Industries

Critical infrastructurediscovered early, communicated responsibly, and mitigated quickly across federal, private, and critical infrastructure networks.”CybersecurityThe federal cybersecurity agency has created a new pathway for people outside of the U.S.Governmentgovernment report vulnerabilities for possible inclusion in the Known Exploited Vulnerabilities catalog.