CISA Ensures Uninterrupted CVE Services with Vital Funding Boost

At a glance

• The Cybersecurity and Infrastructure Security Agency (CISA) has extended funding to keep the Common Vulnerabilities and Exposures (CVE) Program running.
• The move avoids a gap in the system the world uses to name and track security flaws.
• The extension came hours before MITRE’s contract to run the program was due to lapse.
• It keeps CISA’s partnership with MITRE and the wider research community in place for now.
• Key players include CISA, Mitre Corporation, and the researchers and vendors who take part in the CVE Program.

A last-minute extension

The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed it extended funding for the Common Vulnerabilities and Exposures (CVE) Program so that its services continue. The decision came in April 2025, after MITRE warned that its government contract to run the program was about to expire. CISA said it executed an option period on the contract late on April 15, the day before it would have lapsed.

What the CVE Program does

The CVE Program gives every publicly known vulnerability a standard identifier. That shared naming lets vendors, security teams and researchers talk about the same flaw without confusion. Scanners, patch advisories and threat feeds all depend on it. A break in CVE assignments would slow the sharing of information that helps prevent breaches.

Why CISA stepped in

Losing CVE services would have weakened defenses worldwide. CISA, the agency responsible for protecting U.S. critical infrastructure, sponsors the program and said it was committed to keeping it running.

Why gaps are dangerous

Vulnerability disclosure has to be continuous. Organizations need timely identifiers and details to patch before attackers exploit a flaw. A short outage hurts.

MITRE’s role

The extension also keeps MITRE in place. Mitre Corporation runs the program day to day under its contract with CISA, working with a network of CVE Numbering Authorities and researchers who add new entries to the database.

How the security community reacted

Security researchers and journalists warned that letting the program lapse would cause real harm across the industry. Some CVE board members also formed a nonprofit, the CVE Foundation, to plan for the program’s long-term independence.

What the extension does not solve

The extension keeps a key resource running for now. Organizations worldwide can keep relying on CVE identifiers to track flaws and patch quickly.

It buys time, though not much: the option period runs about 11 months, which leaves CISA, MITRE and the CVE board under a year to settle who pays for the program after that and who gets to make decisions about it. The bigger question is how the program will be funded and governed over the long term, and whether it should depend on a single government contract.

What security teams should do

Security teams should keep using CVE identifiers as normal, but it is worth knowing how their tools would cope if the feed stopped. Ask your scanner and patch vendors what backup sources they use, and follow the CVE Foundation and CISA for news on the program’s future.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.