European Vulnerability Database Goes Live

Europe’s new vulnerability-tracking service is now fully live, just weeks after the American-run Common Vulnerabilities and Exposures program had a brush with closure despite its status as a global cybersecurity standard.

See Also: OnDemand | 3 New Ways to Tackle Insider Threats in Government Organizations

The European Vulnerability Database is designed to be a one-stop shop for accessing aggregated, public information pertaining to known vulnerabilities in software and hardware.

Run by the European Union Agency for Cybersecurity, the database is built to provide “a high level of interconnection of publicly available information coming from multiple sources,” comprising not only vulnerability details but also available patches and mitigations, ENISA said.

“The EU Vulnerability Database is a major step towards reinforcing Europe’s security and resilience,” Henna Virkkunen said, the Finnish European Commissioner responsible for technology sovereignty, security and democracy.

The cybersecurity agency said it is now actively soliciting public feedback about how to further refine and improve the vulnerability database.

European officials said the EUVD, which is publicly accessible, offers users three different dashboards: one for critical vulnerabilities, one exploited vulnerabilities and one for EU-coordinated vulnerabilities. The latter vulnerabilities are coordinated by the European CSIRT network, comprising national teams as well as the EU’s own CERT-EU team.

The database draws its information from computer security incident response teams located across Europe. Other sources of information include vendors and vulnerability databases, including U.S. non-profit MITRE’s Common Vulnerabilities and Exposures program.

The CVE Program faced an uncertain future last month, when MITRE warned its federal funding was about to expire. CISA at the extended the program’s funding for 11 months but some members of the program’s all-volunteer board of directors launched fund-raising effort to diversify funding and governance amid worries over the Trump administration’s long-term commitment.

“CVE support is an integral part of cybersecurity and the operation of the Common Vulnerabilities and Exposures program is key for vulnerability management,” a European cybersecurity agency spokesperson told Information Security Media Group. “ENISA is in contact with MITRE to understand the impact and next steps following the announcement on the funding to the Common Vulnerabilities and Exposures Program.”

Many others in the cybersecurity community are also waiting cautiously to see what happens next with the CVE Program, which since 1999 has provided a definitive source of information about vulnerabilities. It has also served “to keep vendors honest and hold them to account,” cybersecurity researcher Daniel Cuthbert said in a social media post (see: Seeking Post-MITRE Management: What’s Next for CVE Program?).

“We had a real big scare, which is enough to have pushed me and other people on the board to get much more serious” about finding new sources of funding, Beardsley said, who until January helmed CISA’s Known Exploited Vulnerabilities catalog (see: CISA’s KEV List: Essential for Real-World Cyber Defense).

In an interview earlier this month at the RSAC Conference in San Francisco, Beardsley told Information Security Media Group the goal of the CVE Foundation will be “to really just collect money from people who care about CVE and put that towards keeping the lights on,” while keeping it under the auspices of MITRE.

The legal question of whether MITRE could receive non-U.S. government funding appears to have been settled. Beardsley said there are numerous examples of government projects that grew and diversified their funding streams, such as the Advanced Research Projects Agency Network – ARPANET – that birthed the internet, or the MITRE Attack framework, which is now partially backed by non-government sources.

Requirement of NIS2 Directive

The requirement to implement an EU vulnerability database comes from the NIS2 Directive, approved by European lawmakers in 2022, which is designed to promote measures that ensure “a high common level of cybersecurity across the union.”

Among other measures, the law requires that EU member states adopt national cybersecurity strategies, establish competent authorities for managing cybersecurity and incident response teams and share cybersecurity information.

The moves are part of a broader push by EU member states to create more robust resilience across the region, while also preventing systemic crises (see: EU Confronts Rising Cyberthreats With Joint Resilience Push).

How quickly security product vendors will offer the ability to ingest EUVD IDs isn’t clear.

Since January 2024, ENISA has also served as a CVE Numbering Authority, or CNA, which allows it to assign CVEs to vulnerabilities in products discovered by EU CSIRTs, or else reported to those CSIRTs, provided they don’t fall under the scope of another CNA.

Currently the CVE program counts 453 CNAs from 40 countries.

Under what circumstances, or if, ENISA might choose to assign a CVE ID – rather than an EUVD ID – to identify any future vulnerabilities isn’t clear.

Regardless, some security experts have lauded the launch of EUVD system for providing greater resilience for managing vulnerabilities. “In cybersecurity, redundancy isn’t wasteful. It’s smart. It is a common practice in cybersecurity. So, why not bring it to vulnerability tracking?” Ferhat Dikbiyik said, chief research and intelligence officer at third-party risk management firm Black Kite.

“For years, the world has relied almost exclusively on the CVE system. It has been working, but recent funding issues show the danger of putting all our trust in a single thread.”