CVE program funding secured, easing fears of repeat crisis

The funding crisis that nearly shut down the CVE program in 2025 has been resolved. CISA and MITRE renegotiated their contract, reportedly moving CVE from discretionary to protected budget status, eliminating the funding cliff that had alarmed the global security community. The CVE board was informed in January 2026 that operations are funded well beyond March. However, the contract remains opaque — even to board members — raising transparency and governance concerns. Meanwhile, the near-collapse spurred global contingency efforts, including the EU launching its own vulnerability database via ENISA, and private firms reserving CVE identifier blocks. Structural questions about long-term governance, international independence, and program modernization remain open.