Government’s Near Miss: The Cybersecurity Database That Almost Vanished

Summary

• The CVE program, the system used worldwide to track software vulnerabilities, nearly lost its federal funding in April 2025.
• MITRE’s contract to run the program was due to expire on April 16, 2025.
• CISA extended the contract at the last minute after a public outcry from the security community.
• The scare raised questions about how the program is funded and governed.

A last-minute rescue

This week the security world got a scare. On April 15, 2025, MITRE warned that its government contract to run the Common Vulnerabilities and Exposures (CVE) program would expire the next day. The CVE program assigns the standard IDs used to track software vulnerabilities around the world. Losing it would have disrupted vulnerability tracking almost everywhere.

Why CVE matters

CVE is the shared catalog of publicly known vulnerabilities. Funded through the Cybersecurity and Infrastructure Security Agency (CISA) and run by MITRE, it gives each flaw a unique ID that vendors, researchers and defenders all use.

Security scanners, patch tools, advisories and national vulnerability databases all rely on those IDs. Without them, coordinating fixes would get much harder, and defenders would struggle to know which bugs they’re talking about.

What went wrong

An earlier version of this article described the near-miss as a budgeting oversight caught during final budget reconciliation. That was not accurate. The issue was the scheduled expiration of MITRE’s contract, at a time when federal agencies were cutting spending. MITRE’s warning letter set off alarm across the industry.

An anonymous quote attributed to a senior CISA official in an earlier version could not be verified and has been removed. CISA said late on April 15 that it had executed the option period on the contract so there would be no lapse in CVE services.

How the industry reacted

The security community reacted quickly. Members of the CVE board launched a separate nonprofit, the CVE Foundation, to work toward independent governance. Vendors and researchers publicly pressed for a long-term fix.

The extension bought about 11 months. It didn’t settle the program’s long-term funding or governance.

What it means for the future

The episode showed how much of the world’s security tooling depends on one program with a single government funder. A short contract gap could have caused confusion for vendors and defenders everywhere.

Some in the industry want CVE moved to a more independent structure with multiple funders, so it isn’t exposed to one agency’s budget decisions.

Lessons from the CVE scare

The close call is a reminder that basic security infrastructure can be fragile. Policymakers, vendors and researchers need a stable way to fund it.

The CVE program survived this time. The next contract deadline is the one to watch.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.