The RCM WG is accepting new members. If you are interested in participating, please email us at cwe@mitre.org.
Microsoft Announces It Will Use CWE for Root Cause Mapping of Its CVEs
On April 8, 2024, Microsoft announced in a Microsoft Security Response Center blog article entitled “Toward greater transparency: Adopting the CWE standard for Microsoft CVEs” that it will now “publish root cause data for Microsoft CVEs using the Common Weakness Enumeration (CWE™) industry standard.”
In addition to explaining how Microsoft will use CWE, along with providing an example of Microsoft CVE Record with CWE information (i.e., in CVE Record CVE-2024-29990, when viewing the JSON for this record), blog author Lisa Olson, Senior Program Manager Security Release at Microsoft, states: “We believe adopting CWE will better serve our customers, developers, and security practitioners across the industry. This standard will facilitate more effective community discussions about finding and mitigating these weaknesses in existing software and hardware, while also minimizing them in future updates and releases. Ultimately, our commitment to CWE represents a meaningful step toward a more cyber-secure world.”