Mitre CVE Program Secures Crucial Funding with CISA Renewal Deal

Mitre CVE Program Secures Crucial Funding with CISA Renewal Deal

The short version

• CISA extended its contract with MITRE to run the CVE Program on April 16, 2025, hours before it was due to lapse.
• The extension runs 11 months, keeping CVE and the related CWE program operating.
• MITRE had warned the day before that funding was about to expire.
• The scare pushed board members to set up a CVE Foundation to plan for long-term independence.

A last-minute extension

On April 15, 2025, MITRE warned members of the CVE board that its contract with the Cybersecurity and Infrastructure Security Agency (CISA) to run the Common Vulnerabilities and Exposures (CVE) Program would expire the next day. The security world reacted fast. Early on April 16, CISA said it had executed the option period on the contract.

“The CVE Program is invaluable to cyber community and a priority of CISA,” the agency said. “Last night, CISA executed the option period on the contract to ensure there will be no lapse in critical CVE services.” The extension runs for 11 months.

Why CVE matters

The CVE Program, run by MITRE with funding from CISA, gives each publicly known vulnerability a unique ID. Vendors, scanners, patch notes and government advisories all use those IDs, so everyone can be sure they are talking about the same flaw.

Hundreds of CVE Numbering Authorities, including large software vendors and security firms, assign IDs under the program’s rules. If MITRE’s work stopped, new vulnerabilities would go without common identifiers and the tools that depend on them would start to drift apart.

Partners in National Security

MITRE is a nonprofit that runs federally funded research centers. It has operated CVE since 1999. The near-lapse came during a broader round of federal budget cuts and contract reviews, which made many in the industry nervous about relying on a single government contract.

An earlier version of this article attributed a statement to Eric Goldstein as CISA’s Executive Assistant Director. Goldstein had left CISA in January 2025, and we could not find such a statement; it has been replaced with CISA’s published statement above.

What happens after 11 months

The extension bought time but did not settle the program’s future. A group of CVE board members announced the CVE Foundation, a nonprofit meant to give the program a more independent footing.

Europe moved too. A few weeks later the European Union Agency for Cybersecurity (ENISA) launched its European Vulnerability Database, which some saw as a backup.

What it means for defenders

For now, CVE IDs keep flowing. Security teams do not need to change anything.

The episode showed how much of the world’s vulnerability tracking rests on one contract, and many vendors and governments began asking what a fallback should look like.

Watch for news on the contract before the 11-month extension ends, and on how the CVE Foundation fits in.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.