The MITRE Corporation’s Common Vulnerabilities and Exposures (CVE) program, an essential tool for identifying and cataloging security vulnerabilities, faces significant uncertainty following the expiration of its government funding on April 16, 2025. Long supported by the U.S. Department of Homeland Security (DHS), the program’s lapse in funding raises alarms within the cybersecurity community about potential disruptions to national and global security measures.
MITRE’s contract to operate and modernize CVE, a cornerstone in the identification and management of cybersecurity vulnerabilities, has not been renewed under the Trump Administration. The loss of financial support threatens the continuity of vulnerability tracking, a critical component in maintaining robust cybersecurity defenses. Without renewed funding, the CVE database, which has identified and cataloged over 250,000 vulnerabilities since 1999, may see significant operational disruptions.
The CVE Board has responded to this challenge by establishing a new nonprofit organization designed to continue the program without government oversight. This move aims to secure the program’s long-term stability and independence but simultaneously raises concerns about potential gaps in vulnerability management and the impact on national security.
The expiration of funding has sparked widespread frustration and concern among cybersecurity professionals. MITRE has highlighted the potential negative consequences for national vulnerability databases, advisories, tool vendors, incident response operations, and critical infrastructure. In the interim, organizations such as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) have stepped in, temporarily extending funding to avoid an immediate lapse in services. However, the overall future of CVE remains uncertain.
MITRE and other industry stakeholders are actively seeking solutions to mitigate the impact of this funding lapse. Historical CVE records will continue to be available on platforms like GitHub, ensuring some continuity in the short term. Meanwhile, organizations and security experts stress that maintaining a standardized and up-to-date repository of vulnerabilities is paramount for effective global cybersecurity coordination.
As discussions about transitioning the CVE program to a new foundation progress, there is an urgent need for collaborative efforts to ensure sustained and stable operations. The cybersecurity community remains alert and watchful, recognizing the pivotal role CVE plays in tracking and mitigating security threats worldwide.

Collections

The Common Vulnerabilities and Exposures (CVE) program, crucial for cataloging security vulnerabilities, faces uncertainty following the expiry of government funding on April 16, 2025. MITRE's contract to operate CVE wasn't renewed, risking program disruption. A nonprofit organization aims to continue its operations independently, raising concerns about potential gaps in vulnerability management and impacts on global security. While temporary funding by CISA ensures short-term continuity, the program's long-term future remains uncertain. Efforts are underway to find solutions and mitigate the impact.

Federal Support for CVE Program to End, Leaving Global Cybersecurity in Jeopardy