CVE Program for Tracking Security Flaws Faces Loss of Federal Funding
Funding Crisis Looms for Critical Cybersecurity Program
The Common Vulnerabilities and Exposures (CVE) program, a cornerstone for cybersecurity efforts worldwide, is facing a dire situation as its funding is set to expire. This program, utilized by tech giants such as Microsoft, Google, Apple, Intel, and AMD, plays a pivotal role in identifying and tracking publicly known cybersecurity vulnerabilities. It's a tool that helps engineers gauge the severity of exploits and prioritize necessary patches or mitigations.
MITRE, the organization behind CVE, has revealed to *The Verge* that its contract to manage and enhance the program is due to end on April 16th. Since its inception in 1999, CVE has maintained a vital database where organizations can assign unique IDs to known vulnerabilities. These IDs, formatted as "CVE" followed by a year and a number (e.g., CVE-2022-27254), enable security professionals to keep tabs on vulnerabilities that could affect everyday devices and critical systems.
Global Impact of CVE Funding Shortfall
Security and privacy researcher Lukasz Olejnik took to X to express his concerns, warning that without continued support, the CVE system could "cripple" global cybersecurity efforts. He emphasized that the absence of CVE could lead to a breakdown in coordination among vendors, analysts, and defense systems, resulting in widespread confusion and a significant weakening of cybersecurity measures.
Despite the looming deadline, Yosry Barsoum, MITRE's vice president and director at the Center for Securing the Homeland, remains optimistic. In an emailed statement to *The Verge*, Barsoum noted that the government is actively working to sustain MITRE's role in the program, and MITRE is committed to maintaining CVE as a global resource. He also mentioned that the funding change could impact the related Common Weakness Enumeration program, which focuses on cataloging hardware and software weaknesses.
Leaked Documents and Official Statements
The urgency of the situation came to light through a leaked letter to CVE board members, which was shared on social platforms X and Bluesky. MITRE, which receives its funding from the US Department of Homeland Security (DHS) and the Cybersecurity and Infrastructure Security Agency (CISA), is tasked with operating and advancing the CVE Program as an independent, objective third party, as outlined in an official video about the program.

The potential discontinuation of funding for the CVE program is a stark reminder of the fragile nature of cybersecurity infrastructure. As the deadline approaches, the tech community and security professionals worldwide are watching closely, hoping for a resolution that will keep this essential tool operational.
Related article
Microsoft, Azure and AI Tech Combat California Wildfire Risks
Microsoft invests in AI-driven wildfire detection, with Juan Lavista Ferres, CVP and Chief Data Scientist, discussing strategies to mitigate environmental damage.According to NASA, climate change impacts everyone on Earth, manifesting as rising tempe
Microsoft CEO Slams AI Labs Over Distillation
Satya Nadella, Microsoft’s CEO, calls out AI labs for hypocrisy regarding distillation criticism, a remark widely interpreted as targeting Anthropic. Credit: Getty ImagesMicrosoft CEO Satya Nadella challenges AI developers for limiting model distilla
OpenAI Leads 100-Signatory Push for Cyber Defence
OpenAI’s letter begins stating "we have a limited window to strengthen cyber defences". Credit: Getty ImagesMajor tech firms – including AWS, Google and Microsoft – urge governments to fund defensive tools, while critics call the manifesto self-servi
Related Special Topic Recommendations
Comments (32)
0/500
The CVE program is crucial for keeping our digital world safe, but it's shocking to hear it might lose funding! 😱 We need to support this program to keep up with cybersecurity threats. Can't imagine the chaos without it. Let's hope the government steps up!
CVE प्रोग्राम हमारी डिजिटल सुरक्षा के लिए महत्वपूर्ण है, और यह सोचकर डर लगता है कि इसकी फंडिंग खत्म हो सकती है! 😱 यह साइबर दुनिया में एक रक्षक को खोने जैसा है। मुझे उम्मीद है कि वे इसे जारी रखने का कोई तरीका ढूंढ लेंगे, नहीं तो हम सब मुश्किल में हैं। और फंड के लिए लड़ते रहो, लोग!
The CVE program losing funding is a huge blow to cybersecurity! 😱 It's like the backbone of our security efforts, and now it's in jeopardy. I hope they find a way to keep it going, or we're all in trouble. Fingers crossed! 🤞
Funding Crisis Looms for Critical Cybersecurity Program
The Common Vulnerabilities and Exposures (CVE) program, a cornerstone for cybersecurity efforts worldwide, is facing a dire situation as its funding is set to expire. This program, utilized by tech giants such as Microsoft, Google, Apple, Intel, and AMD, plays a pivotal role in identifying and tracking publicly known cybersecurity vulnerabilities. It's a tool that helps engineers gauge the severity of exploits and prioritize necessary patches or mitigations.
MITRE, the organization behind CVE, has revealed to *The Verge* that its contract to manage and enhance the program is due to end on April 16th. Since its inception in 1999, CVE has maintained a vital database where organizations can assign unique IDs to known vulnerabilities. These IDs, formatted as "CVE" followed by a year and a number (e.g., CVE-2022-27254), enable security professionals to keep tabs on vulnerabilities that could affect everyday devices and critical systems.
Global Impact of CVE Funding Shortfall
Security and privacy researcher Lukasz Olejnik took to X to express his concerns, warning that without continued support, the CVE system could "cripple" global cybersecurity efforts. He emphasized that the absence of CVE could lead to a breakdown in coordination among vendors, analysts, and defense systems, resulting in widespread confusion and a significant weakening of cybersecurity measures.
Despite the looming deadline, Yosry Barsoum, MITRE's vice president and director at the Center for Securing the Homeland, remains optimistic. In an emailed statement to *The Verge*, Barsoum noted that the government is actively working to sustain MITRE's role in the program, and MITRE is committed to maintaining CVE as a global resource. He also mentioned that the funding change could impact the related Common Weakness Enumeration program, which focuses on cataloging hardware and software weaknesses.
Leaked Documents and Official Statements
The urgency of the situation came to light through a leaked letter to CVE board members, which was shared on social platforms X and Bluesky. MITRE, which receives its funding from the US Department of Homeland Security (DHS) and the Cybersecurity and Infrastructure Security Agency (CISA), is tasked with operating and advancing the CVE Program as an independent, objective third party, as outlined in an official video about the program.
The potential discontinuation of funding for the CVE program is a stark reminder of the fragile nature of cybersecurity infrastructure. As the deadline approaches, the tech community and security professionals worldwide are watching closely, hoping for a resolution that will keep this essential tool operational.
Microsoft, Azure and AI Tech Combat California Wildfire Risks
Microsoft invests in AI-driven wildfire detection, with Juan Lavista Ferres, CVP and Chief Data Scientist, discussing strategies to mitigate environmental damage.According to NASA, climate change impacts everyone on Earth, manifesting as rising tempe
Microsoft CEO Slams AI Labs Over Distillation
Satya Nadella, Microsoft’s CEO, calls out AI labs for hypocrisy regarding distillation criticism, a remark widely interpreted as targeting Anthropic. Credit: Getty ImagesMicrosoft CEO Satya Nadella challenges AI developers for limiting model distilla
OpenAI Leads 100-Signatory Push for Cyber Defence
OpenAI’s letter begins stating "we have a limited window to strengthen cyber defences". Credit: Getty ImagesMajor tech firms – including AWS, Google and Microsoft – urge governments to fund defensive tools, while critics call the manifesto self-servi
The CVE program is crucial for keeping our digital world safe, but it's shocking to hear it might lose funding! 😱 We need to support this program to keep up with cybersecurity threats. Can't imagine the chaos without it. Let's hope the government steps up!
CVE प्रोग्राम हमारी डिजिटल सुरक्षा के लिए महत्वपूर्ण है, और यह सोचकर डर लगता है कि इसकी फंडिंग खत्म हो सकती है! 😱 यह साइबर दुनिया में एक रक्षक को खोने जैसा है। मुझे उम्मीद है कि वे इसे जारी रखने का कोई तरीका ढूंढ लेंगे, नहीं तो हम सब मुश्किल में हैं। और फंड के लिए लड़ते रहो, लोग!
The CVE program losing funding is a huge blow to cybersecurity! 😱 It's like the backbone of our security efforts, and now it's in jeopardy. I hope they find a way to keep it going, or we're all in trouble. Fingers crossed! 🤞





Home






