News & Events - 2026Right-click and copy a URL to share an article. Send feedback about this page to cwe@mitre.org. CWE Program Announces Upcoming Schema 8.0 Changes for CWE 5.0 September 3, 2026 | Share this article The CWE™ Program is preparing a significant update to the CWE List data model with the release of CWE 5.0. This release will introduce Schema 8.0 for the XML schema and JSON representation, bringing several important structural changes that may affect how tools and programs access, extract, and process CWE content. Among the most significant Schema 8.0 updates are a major terminology shift from “Category” to “Grouping,” the introduction of new elements such as Technical_Nuance and Dimensions to capture richer technical meaning, and expanded support for representing multiple submitters and contributors more accurately. The new schema also strengthens relationship modeling by allowing dimensions and notes on relationships and by adding an Overlaps relationship type, while introducing more flexible lifecycle support through Custom_Phases for domains such as AI and hardware. In addition, Mode_of_Introduction and Detection_Method entries can now include multiple phases, and several naming and metadata updates, including namespace and note enhancements. Some of the changes are breaking changes. See more below. While a few additional minor updates may still be introduced in September 2026, the current draft of Schema 8.0 is considered fairly stable, and consumers are encouraged to begin reviewing the changes now. For detailed information about this upcoming release, please review the following sections of this article:
BREAKING CHANGES Supporting Existing Consumers with Parallel 7.x Releases To help minimize disruption for current users, the CWE Program will continue to provide data in the Schema 7.x format alongside the new Schema 8.0 content. CWE 5.0 will use Schema 8.0 in order to better express new concepts being added to the corpus. At the same time, the program will continue publishing Schema 7.x-compatible releases for organizations and tools that depend on the existing format. These schema-7-only releases will continue the CWE 4.x versioning pattern, with CWE 4.21 planned as a parallel release to CWE 5.0. This means existing integrations are unlikely to break immediately, although newer 8.x-only concepts may be harder to extract from the 7.x representation. In those cases, the additional information will generally appear as supplementary Notes in the 7.x-formatted content. What This Means for Consumers Organizations that use CWE data in security tools, reporting pipelines, content analysis, or internal knowledge systems should begin evaluating Schema 8.0 now. Even with the availability of parallel Schema 7.x releases, the new schema introduces important structural and naming changes that may require updates to parsers, validators, mappers, and downstream processing logic. At the same time, the parallel release strategy should give consumers time to adapt without disrupting existing workflows. MAIN CHANGES A Major Terminology Change: “Category” Becomes “Grouping” One of the most visible changes in Schema 8.0 is the replacement of the term “Category” with “Grouping.” This change is intended to reduce longstanding community confusion between categories and classes. As part of this update:
Any consumers that reference these element names directly should plan for updates. New Elements for Richer Technical Meaning Schema 8.0 introduces new elements designed to better capture nuance and structure within CWE entries.
Expanded Content History Support Schema 8.0 improves how contributions and submissions are represented.
These changes make it easier to accurately represent multiple submitters and contributors without relying on comma-separated text values. Custom Development Lifecycle Phases for AI and Hardware CWE 5.0 and Schema 8.0 also add support for custom product lifecycle phases across different domains through the Custom_Phases element. Current supported domains include AI and Hardware, using enumerations such as AIPhaseEnumeration and HardwarePhaseEnumeration. Custom_Phases can be used in:
This provides a more flexible way to represent lifecycle-specific guidance for domains whose development processes do not always map neatly to traditional software phases. Relationship Modeling Gets Stronger Several important enhancements are also being made to relationships across the CWE List.
Multiple phases for introduction and detection Any Mode_of_Introduction or Detection_Method can now have more than one Phase. This aligns those areas more closely with how Potential_Mitigations have been represented for years. Additional Changes to Watch Several other updates are included in Schema 8.0:
DRAFT SCHEMA FOR COMMUNITY REVIEW To support early adoption and testing, the CWE Program has made both draft schema files and sample data available:
Consumers who validate, transform, or ingest CWE content should review these files as part of their migration planning. LOOKING AHEAD Schema 8.0 is a substantial step forward for the CWE List, enabling the program to represent technical nuance, dimensions, lifecycle context, and relationships with greater clarity and precision. For the CWE community, that means richer content and a stronger foundation for future growth. Consumers are encouraged to review the draft schema and sample data early, test their integrations, and prepare for the transition as CWE 5.0 approaches. FEEDBACK REQUESTED Please send any comments or concerns to cwe@mitre.org. Join the CWE Cross-Domain Special Interest Group (XD-SIG)! September 3, 2026 | Share this article The CWE Program is launching a new “CWE Cross-Domain Special Interest Group (XD-SIG).” The XD-SIG is intended to be an open, collaborative forum that brings together contributors from across industry, government, academia, and the cybersecurity community. We invite you to join this collaborative effort as a core member of the XD-SIG community. Mission By unifying previous domain-specific efforts, the XD-SIG aims to:
Membership & Community Engagement Core Member Meetings As active contributors to the XD-SIG, core members are expected to:
Community Workshops Quarterly workshops will be held for the broader CWE community to share updates, demonstrate progress, and gather feedback on XD-SIG initiatives. Workshops are expected to average approximately two hours, depending on discussion topics. Ways to Get Involved Meeting dates and times are currently to be determined. If you would like to participate, please send an email to cwe@mitre.org. Videos of Two CWE-Focused Sessions at VulnCon 2026 Now Available June 10, 2026 | Share this article Videos of two CWE-focused sessions — “From Roadmap to Results: Measuring CWE Adoption to Enable Prevention” (presentation) and “Boosting Vulnerability Intelligence: How Accurate CWE Mappings Transform ML Model Performance” (presentation) — from CVE/FIRST VulnCon 2026 are now available on the CWE YouTube Channel. Or, watch below: CWE Referenced in IEEE Paper on LLM-Assisted Hardware Vulnerability Discovery June 10, 2026 | Share this article CWE™ and the 2025 CWE Most Important Hardware Weaknesses (MIHW) are referenced throughout the IEEE conference workshop paper “LLM-HyPZ: Hardware Vulnerability Discovery Using an LLM-Assisted Hybrid Platform for Zero-Shot Knowledge Extraction and Refinement.” The paper was published in the proceedings of the 2025 IEEE International Conference on Data Mining Workshops (ICDMW) and added to IEEE Xplore on March 10, 2026. The paper describes LLM-HyPZ, an LLM-assisted hybrid framework for identifying and refining hardware vulnerability knowledge from CVE data. The authors’ contributions to the Most Important Hardware Weaknesses (MIHW) Working Group informed the creation of the 2025 CWE MIHW. Their LLM-HyPZ work helped identify hardware-related CVEs and narrow the candidate search space used in the MIHW analysis. Citation: Yu-Zheng Lin, Sujan Ghimire, Abhiram Nandimandalam, Jonah Michael Camacho, Unnati Tripathi, Rony Macwan, Sicong Shao, Setareh Rafatirad, Rozhin Yasaei, Pratik Satam, and Soheil Salehi, “LLM-HyPZ: Hardware Vulnerability Discovery Using an LLM-Assisted Hybrid Platform for Zero-Shot Knowledge Extraction and Refinement,” 2025 IEEE International Conference on Data Mining Workshops (ICDMW), Washington, DC, USA, 2025, pp. 1268-1273, doi: 10.1109/ICDMW69685.2025.00150. CWE Podcast: “CWE Top 25 Most Dangerous Software Weaknesses” May 13, 2026 | Share this article “Out-Of-Bounds Read” is the CWE Program’s free podcast about common weaknesses in software and hardware, the vulnerabilities they cause, how to reduce them, and how using CWE can help make products more secure by design. In this episode, MITRE’s CWE™ and CVE™ Project Lead Alec Summers talks with CWE Technical Lead Steve Christey and CWE Top 25 Lead Connor Mullaly about the 2025 “CWE Top 25 Most Dangerous Software Weaknesses.” Topics include what the CWE Top 25 is and why it matters for software security; how the list is calculated using prevalence and average severity; how the quality of mappings in CVE Records affects the accuracy and usefulness of the list; how CVE Numbering Authorities (CNAs) help build the list; common mapping problems, especially choosing overly broad or discouraged entries instead of more specific ones; changes in methodology for the 2025 list, especially moving away from normalizing everything into a smaller subset and instead reflecting what actually mapped in the full corpus; and practical advice for better root cause mapping, including using mapping notes, avoiding discouraged entries, and focusing on the underlying weakness rather than just the impact. 
The podcast is available for free on the CWE Program Channel on YouTube. Please give our latest episode a listen and let us know what you think by commenting on the CWE page on LinkedIn, CWE on X, CWE on Mastodon, or CWE on Bluesky. We look forward to hearing from you! CWE Version 4.20 Now Available April 30, 2026 | Share this article CWE Version 4.20 has been posted on the CWE List page. A detailed report is available that lists specific changes between Version 4.19.1 and Version 4.20. Main Changes CWE 4.20 includes 1 new view to congregate common AI-related weaknesses and 2 new categories related to the new AI view; added Observed Examples (i.e., in-the-wild CVE examples) to 20+ CWEs to improve entry completeness; added detection methods and mitigations to 20+ CWEs; updated vulnerability mapping notes for 15+ CWEs; added content modifications from several community submissions via the CWE Content Development Repository (CDR); usability improvements (i.e., diagrams, clarified language, better utility of schema elements) for 9 CWEs; added CWE version and release date information for older modifications before CWE 4.14; among other updates. One new view added: Two new categories related to the Weaknesses Related to AI/ML Products view added:
Usability Improvements
Content History
Schema Changes There were no schema changes. Summary There are 944 weaknesses and a total of 1,450 entries on the CWE List. Changes for the new version include the following:
See the complete list of changes at https://cwe.mitre.org/data/reports/diff_reports/v4.19.1_v4.20.html. Future updates will be noted here, on the CWE page on LinkedIn, on CWE on X, and on CWE on Mastodon, and on CWE on Bluesky. Please contact us with any comments or concerns. CWE Is Focus of Three Talks at VulnCon 2026 April 8, 2026 | Share this article CWE is the main focus of three talks at CVE/FIRST VulnCon 2026 being held at the DoubleTree Resort by Hilton Hotel Paradise Valley – Scottsdale, in Scottsdale, Arizona, USA, on April 13-16, 2026:
Feel free to contact us on CWE social media or at cwe@mitre.org with any feedback about these presentations. “2025 CWE Top 10 KEV Weaknesses” List Now Available January 29, 2026 | Share this article The “2025 CWE Top 10 KEV Weaknesses” list, which lists the top ten CWEs in the Cybersecurity and Infrastructure Security Agency’s (CISA) “Known Exploited Vulnerabilities (KEV) Catalog,” is now available on the CWE website. The KEV is a database of security flaws in software applications and weaknesses that have been exposed and leveraged by attackers. Each vulnerability listed in KEV is identified by, and links to, a CVE Record. CISA recommends that organizations monitor the KEV catalog and use its content to help prioritize remediation activities in their systems to reduce the likelihood of compromise. Our analysis/key insights about the 2025 Top 10 KEV Weaknesses list are available here, and our methodology for creating the list is here.  View the full CWE Top 10 KEV list here. 2025 CWE Top 25 Weaknesses “On the Cusp” List Now Available January 29, 2026 | Share this article A list of the fifteen additional weaknesses that were “on the cusp” of being included in the “2025 CWE Top 25 Most Dangerous Software Weaknesses” list is now available on the 2025 “On the Cusp” List page. These CWEs, ranked in positions 26-40, were not included in the 2025 CWE Top 25 but continue to be prevalent and severe enough to cause concern. View the 2025 On the Cusp Insights. CWE Version 4.19.1 Now Available January 21, 2026 | Share this article CWE Version 4.19.1 has been posted on the CWE List page. CWE 4.19.1 is an unscheduled release that fixes incorrect relationships in the Weaknesses in the 2025 CWE Top 25 Most Dangerous Software Weaknesses view. The updated View-1435 now contains the correct relationships. There were no other changes. A detailed report is available that lists specific changes between Version 4.19 and Version 4.19.1. Summary There are 944 weaknesses and a total of 1,447 entries on the CWE List. Changes for the new version include the following:
See the complete list of changes at https://cwe.mitre.org/data/reports/diff_reports/v4.19_v4.19.1.html. Future updates will be noted here, on the CWE Research email discussion list, CWE page on LinkedIn, on CWE on X, and on CWE on Mastodon, and on CWE on Bluesky. Please contact us with any comments or concerns. |
