The Common Vulnerabilities and Exposures (CVE) program, a crucial element of the global cybersecurity efforts, recently encountered a significant funding challenge due to federal budget cuts. The program is managed by the non-profit MITRE corporation and is a vital tool for businesses all around the world as it helps with cataloging publicly disclosed cybersecurity vulnerabilities.
The program’s contract was scheduled to end on April 16,2025, which raised concerns regarding potential disruptions in vulnerability tracking and coordination. The Cybersecurity and Infrastructure Security Agency (CISA) responded by extending the contract at the last minute, guaranteeing the program’s ongoing operations for the time being.
In the absence of a new agreement, MITRE apparently started planning for a suspension in operations, which would put a temporary stop to the issue of new CVE identifiers. The uncertainty raised concern among software engineers and security experts who rely on timely, standardized vulnerability reports for risk management and response coordination.
“If you lose CVEs, you lose common language,” said Harley Geiger, former policy director at Rapid7. “Everyone ends up speaking different dialects of risk. That’s how things fall through the cracks.”
Despite this temporary reprieve, the situation has brought to light the risks associated with depending exclusively on federal funding for such vital infrastructure. To ensure the program’s survival and fairness amid these events, CVE board members have suggested transforming it into a separate non-profit foundation.
Art Manion, a CVE Board member and researcher at CERT/CC, highlighted the broader implications of the event: “We need a system that’s stable, neutral, and sustainable. We can’t keep playing chicken with critical infrastructure.” Advocates argue that switching to a foundation model would allow for a community-driven governance, diversify financing sources, and boost international involvement in vulnerability management.
Although CVE began as a U.S. federal initiative, it is now a globally used standard. CVE entries are used by governments, cloud service providers, and IT firms globally for vulnerability disclosure, threat assessment, and patch prioritization.
The recent funding challenges have also sparked discussions about the need for a more robust and community-oriented model for vulnerability tracking. The significance of sustaining and supporting programs like CVE remain vital as cybersecurity threats continue to evolve. CISA Senior Advisor Allan Friedman commented on the situation: “The CVE program is not just another federal IT project, it’s a critical component of the world’s cybersecurity infrastructure. Letting it lapse would have sent ripples across the globe.”
While operations continue under the renewed contract, the incident has sparked urgent discussions about how to future-proof the CVE program within the cybersecurity community. A long-term, globally supported governance architecture is being demanded by stakeholders to guarantee its ongoing resilience in the face of growing cyberthreats and administrative uncertainties.
