Cybersecurity Alarms Sound as CVE Program Funding Ceases

Warnings are being sounded over the risk to global cybersecurity posed by the imminent disruption or management shutdown of the Common Vulnerabilities and Exposures program. A fix could be forthcoming in the form of a stand-alone foundation, although details and funding for the new organization remain unclear.

See Also: Breaches Won’t Stop Until We Wise Up

Federal contracting firm Mitre, which manages the CVE and other programs, including the Common Weakness Enumeration list of software and hardware weaknesses, issued an urgent Tuesday letter to CVE board members, warning that “the current contracting pathway for Mitre to develop, operate and modernize CVE and several other related programs, such as CWE,” hadn’t been renewed by the U.S. government and would expire within 24 hours.

“If a break in service were to occur, we anticipate multiple impacts to CVE, including deterioration of national vulnerability databases and advisories, tool vendors, incident response operations and all manner of critical infrastructure,” it said.

“While this may sound like a technical issue, it has serious implications for business risk, operational resilience and national security,” said Jen Easterly, who served as President Joe Biden’s head of the U.S. Cybersecurity and Infrastructure Security Agency, in a post to LinkedIn.

Any disruption to the information-sharing framework “is rightly raising alarms across the cybersecurity community,” Easterly said. Specific risks include higher security and compliance costs for businesses, due to slower incident response and the increased risk of suffering a data breach, ransomware attack or other major security incident, she said.

In response, a collation of active, long-time CVE Board members on Wednesday announced the launch of a new, non-profit CVE Foundation, saying they’ve been preparing for this worst-case scenario for the past year.

How the foundation might get funded remains unclear, and could become a sticking point. “Over the coming days, the foundation will release more information about its structure, transition planning and opportunities for involvement from the broader community,” it said.

The Mitre contracting cuts appear to be the result of Elon Musk’s federal cost-cutting task force, the Department of Government Efficiency (see: Whistleblower Accuses DOGE of Data-Harvesting Cover Up).

Non-profit Mitre has for decades spearheaded public-private partnerships at government-owned, contractor-operated research centers, conducting research and prototyping projects in support of various federal agencies and their missions. That included the CVE Program, launched in 1999 to identify, define and catalog publicly disclosed cybersecurity vulnerabilities – in effect creating a common, international language for doing so. So-called CVEs serve as a cornerstone of national computer emergency response teams’ guidance to organizations, help guide and prioritize enterprise vulnerability management efforts and hold vendors to account for their code security.

“The CVE program is foundational infrastructure,” said Tim Peck, a senior threat researcher at information and event management platform Securonix. It’s not just a nice to have ‘referenceable list,’ it’s a primary resource for vulnerability coordination, prioritization and response efforts across the private sector, government and open source.”

Multiple defensive tools rely on CVE metadata. The information is also a cornerstone for programs such as CISA’s Known Exploited Vulnerabilities catalog – used to set patching priorities for federal agencies – as well as other national cybersecurity agencies’ domestic guidance (see: Zero Days Top Cybersecurity Agencies’ Most-Exploited List).

The CVE Program hasn’t been perfect. In recent years, security researchers frequently reported delays in Mitre assigning CVEs vulnerabilities they submitted. Many traced this to the surge in vulnerabilities being discovered and needing to be cataloged. Published CVEs rose from 28,818 CVE in 2023 to 40,009 in 2024, a nearly 40% increase, said security research Jerry Gamblin.

CVE reports get filed by a number of third-party organizations, including security firms, government agencies and non-profit entities such as The Shadowserver Foundation; vendors who disclose flaw in their own and others’ products; as well as independent security researchers, according to Lexington, Massachusetts-based vulnerability intelligence firm VulnCheck.

Many CVEs require immediate attention, because they’re cataloging exploits that attackers are already exploiting in the wild. In 2024, VulnCheck said 768 of published CVEs were reported as being already exploited in the wild, up 20% from 639 CVEs in 2023.

How quickly the CVE Foundation might get up and running, and if it can foster widespread buy-in, isn’t yet clear. “Hopefully this situation gets resolved quickly,” said Casey Ellis, founder of California-based crowdsourced security firm Bugcrowd. “A sudden interruption in services has the very real potential to bubble up into a national security problem in short order.”

As a short-term workaround, VulnCheck has pledged “to perform CVE assignments for the community in the coming days and weeks,” and to facilitate this has already “proactively pre-allocated” 1,000 CVEs for 2025 and will try to get more.

Anyone wanting to gain a fresh CVE assignment can access the company’s reporting service, which has already been used by multiple threat intelligence firms – including GreyNoise Intelligence, Horizon3.ai and watchTowr – said Patrick Garrity, a security researcher at VulnCheck.

Assuming the CVE Foundation gets up and running, its launch announcement leaves unclear if it might also attempt to spearhead the Common Weaknesses Enumeration Project that Mitre has run. Securonix’s Peck said the CWE project remains “vital for software weakness classification and prioritization,” and that any disruption to it “would affect secure coding practices and risk assessments.”