CWE™ Program Announces Upcoming Schema 8.0 Changes for CWE 5.0

The CWE Program is preparing a significant update to the CWE List data model with the release of CWE 5.0. This release will introduce Schema 8.0 for the XML schema and JSON representation, bringing several important structural changes that may affect how tools and programs access, extract, and process CWE content.

Among the most significant Schema 8.0 updates are a major terminology shift from "Category" to "Grouping," the introduction of new elements such as Technical_Nuance and Dimensions to capture richer technical meaning, and expanded support for representing multiple submitters and contributors more accurately. The new schema also strengthens relationship modeling by allowing dimensions and notes on relationships and by adding an Overlaps relationship type, while introducing more flexible lifecycle support through Custom_Phases for domains such as AI and hardware. In addition, Mode_of_Introduction and Detection_Method entries can now include multiple phases, and several naming and metadata updates, including namespace and note enhancements. Some of the changes are breaking changes. See more below.

While a few additional minor updates may still be introduced in September 2026, the current draft of Schema 8.0 is considered fairly stable, and consumers are encouraged to begin reviewing the changes now.

BREAKING CHANGES

Supporting Existing Consumers with Parallel 7.x Releases

To help minimize disruption for current users, the CWE Program will continue to provide data in the Schema 7.x format alongside the new Schema 8.0 content.

CWE 5.0 will use Schema 8.0 in order to better express new concepts being added to the corpus. At the same time, the program will continue publishing Schema 7.x-compatible releases for organizations and tools that depend on the existing format. These schema-7-only releases will continue the CWE 4.x versioning pattern, with CWE 4.21 planned as a parallel release to CWE 5.0.

This means existing integrations are unlikely to break immediately, although newer 8.x-only concepts may be harder to extract from the 7.x representation. In those cases, the additional information will generally appear as supplementary Notes in the 7.x-formatted content.

What This Means for Consumers

Organizations that use CWE data in security tools, reporting pipelines, content analysis, or internal knowledge systems should begin evaluating Schema 8.0 now. Even with the availability of parallel Schema 7.x releases, the new schema introduces important structural and naming changes that may require updates to parsers, validators, mappers, and downstream processing logic.

At the same time, the parallel release strategy should give consumers time to adapt without disrupting existing workflows.

MAIN CHANGES

A Major Terminology Change: "Category" Becomes "Grouping"

One of the most visible changes in Schema 8.0 is the replacement of the term "Category" with "Grouping."

This change is intended to reduce longstanding community confusion between categories and classes. As part of this update:

• The Category element will be removed and replaced with Grouping

Any consumers that reference these element names directly should plan for updates.

New Elements for Richer Technical Meaning

Schema 8.0 introduces new elements designed to better capture nuance and structure within CWE entries.

• Technical_Nuance — A new Technical_Nuance element will provide focused explanations or technical details related to a weakness. This should help consumers better understand finer-grained distinctions and contextual details.
• Dimensions — The new Dimensions element identifies the key aspects of a weakness that a CWE entry focuses on, such as behavior, resource, or technology type or property. Making these aspects explicit can improve precision and support more sophisticated analysis.

Expanded Content History Support

Schema 8.0 improves how contributions and submissions are represented.

• More than one Submission element can now be used
• More than one Submission_Name can be used within each Submission
• More than one Contribution_Name can be used within a Contribution element

These changes make it easier to accurately represent multiple submitters and contributors without relying on comma-separated text values.

Custom Development Lifecycle Phases for AI and Hardware

CWE 5.0 and Schema 8.0 also add support for custom product lifecycle phases across different domains through the Custom_Phases element.

Current supported domains include AI and Hardware, using enumerations such as AIPhaseEnumeration and HardwarePhaseEnumeration.

Custom_Phases can be used in:

• Potential_Mitigations
• Modes_Of_Introduction
• Detection_Methods

This provides a more flexible way to represent lifecycle-specific guidance for domains whose development processes do not always map neatly to traditional software phases.

Relationship Modeling Gets Stronger

Several important enhancements are also being made to relationships across the CWE List.

• Dimensions on relationships — Relationships defined in Related_Weaknesses for Weaknesses, Members for Views, and Relationships for Groupings can now include Dimensions sub-elements. These are intended to capture the dimensions along which two CWEs differ. For example, a ChildOf relationship might reflect that the child describes a more specific kind of resource.
• New relationship nature: Overlaps — A new relationship nature, Overlaps, has been added to represent the uncommon case in which multiple CWEs overlap each other. Although this does not introduce major syntax changes, consumers that process relationship semantics may need additional customization. As with PeerOf, the Overlaps relationship should be understood as symmetric.
• Relationship notes — Relationships can now include Note elements that provide additional explanation or context for the relationship itself. This capability is expected to be used infrequently, but it adds useful expressiveness where needed.

Multiple phases for introduction and detection

Any Mode_of_Introduction or Detection_Method can now have more than one Phase. This aligns those areas more closely with how Potential_Mitigations have been represented for years.

Additional Changes to Watch

Several other updates are included in Schema 8.0:

• Any Note type under the Notes element can now specify the associated CWE Version and ReleaseDate. This is expected to be especially useful for Maintenance and Research Gap notes.
• The targetNamespace will change to http://cwe.mitre.org/cwe-8
• Under Alternate_Terms, each Term can now include a Role sub-element to identify how the term is used, such as an abbreviation or alternate spelling. See AlternateTermRoleEnumeration.
• Under Applicable_Platforms, each sub-element type, including Language, Operating_System, and Architecture, now supports a Note

DRAFT SCHEMA FOR COMMUNITY REVIEW

To support early adoption and testing, the CWE Program has made both draft schema files and sample data available on the CWE website:

• Draft schema: cwe_schema_v8.0-DRAFT-1_xsd
• Test data XML: DRAFT-CWE-SCHEMA-8-CONTENT_xml

Consumers who validate, transform, or ingest CWE content should review these files as part of their migration planning.

LOOKING AHEAD

Schema 8.0 is a substantial step forward for the CWE List, enabling the program to represent technical nuance, dimensions, lifecycle context, and relationships with greater clarity and precision. For the CWE community, that means richer content and a stronger foundation for future growth.

Consumers are encouraged to review the draft schema and sample data early, test their integrations, and prepare for the transition as CWE 5.0 approaches.

Get the most up-to-date information on the CWE website.