Cybersecurity Crisis Looms as CVE Program Faces Uncertainty

At a glance

• The CVE Program, a cornerstone of cybersecurity, faced a funding lapse in April 2025.
• Security professionals warned of gaps in vulnerability tracking.
• Some called for decentralized alternatives.
• Industry leaders urged quick action to keep the program running.

What the CVE Program does

The Common Vulnerabilities and Exposures (CVE) Program has been a foundation of cybersecurity for more than two decades. Run by MITRE, it assigns standard identifiers to known vulnerabilities. Everyone uses them.

The funding scare

In April 2025, MITRE warned that its government contract to run the CVE Program was set to expire on April 16. According to a recent report accessible via Forbes, a lapse could interrupt the flow of vulnerability information. Patching would suffer. CISA then said it had executed an option period on the contract to avoid a lapse in service, buying the program 11 more months while the longer-term funding question stayed open.

Why the industry worried

Companies and government agencies alike depend on CVE identifiers, which show up in security tools, patch processes and advisories. If the program went dark, defenders would lose a shared reference point for tracking flaws and would have to match vendor bulletins by hand.

Without a central system, tracking vulnerabilities across vendors and tools would quickly become chaotic.

Calls for alternatives

The scare prompted talk of decentralized vulnerability tracking, with some suggesting blockchain or AI-based systems.

Others proposed crowd-sourced approaches to identifying and tracking flaws.

Any replacement would be complex and slow to build, and the episode raised a hard question. Could the industry adapt fast enough if CVE funding failed for real?

What industry leaders asked for

Security leaders called for government action and more private funding. They argued that a gap in CVE coverage would affect national and global security.

Stable funding would let the program improve instead of lurching from one deadline to the next.

The lesson

The CVE scare showed how much of security depends on a few shared systems. A lapse would hit defenders everywhere. Long-term funding matters more than a last-minute rescue.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.