CISA secures one-year extension for MITRE's CVE funding amid uncertainty
U.S. government funding for MITRE's CVE program faced a lapse but CISA approved a one-year contract extension, prompting the CVE Board to form a new foundation for long-term stability.
Key points
- CISA announced a contract extension to keep CVE funding active for another year.
- MITRE warned a funding gap could delay vulnerability advisories and increase risk to critical infrastructure.
- The CVE Board created the CVE Foundation to seek sustainable, independent financing.
A wave of uncertainty swept the cybersecurity world this week as U.S. government funding for MITRE’s Common Vulnerabilities and Exposures (CVE) program teetered on the brink of expiration—threatening to disrupt the backbone of global vulnerability tracking. The CVE program, a critical re
MITRE, the non-profit stewarding CVE, warned that a funding gap could lead to widespread impacts: delays in vulnerability advisories, degraded incident response, and heightened risk for critical infrastructure. The cybersecurity community voiced alarm, calling CVE “essential for anyone engaged in vulnerability management or security research” and warning that no alternative exists at this scale.
In a dramatic last-minute move, the Cybersecurity and Infrastructure Security Agency (CISA) announced it had secured a contract extension, ensuring no immediate lapse in CVE services. Still, the reprieve is temporary—funding is only guaranteed for another year, leaving the long-term future of the CVE program in question.
To address sustainability concerns, CVE Board members have launched the CVE Foundation, a new non-profit aiming to safeguard the program’s independence and stability beyond government cycles. As the dust settles, the cybersecurity industry is left watching closely: Will the world’s vulnerability database remain resilient, or is this just the beginning of a deeper reckoning?
Your questions, answered
What caused the recent funding uncertainty for the CVE program?
The U.S. government funding for MITRE's CVE program was set to expire, creating a risk of a funding gap.
How long is the new funding extension for the CVE program?
The extension secured by CISA provides funding for an additional year.
What is the CVE Foundation?
It is a new non‑profit launched by CVE Board members to ensure the program’s independence and long‑term stability.
Quick poll
Do you think a government‑backed extension is sufficient for the CVE program’s long‑term health?
0 votes
How does this story make you feel?
Topics
Up next · Tech4chan outage sparks speculation about Anonymous involvement
