CVE Program for Tracking Security Flaws Faces Loss of Federal Funding

Funding Crisis Looms for Critical Cybersecurity Program

The Common Vulnerabilities and Exposures (CVE) program, a cornerstone for cybersecurity efforts worldwide, is facing a dire situation as its funding is set to expire. This program, utilized by tech giants such as Microsoft, Google, Apple, Intel, and AMD, plays a pivotal role in identifying and tracking publicly known cybersecurity vulnerabilities. It's a tool that helps engineers gauge the severity of exploits and prioritize necessary patches or mitigations.

MITRE, the organization behind CVE, has revealed to *The Verge* that its contract to manage and enhance the program is due to end on April 16th. Since its inception in 1999, CVE has maintained a vital database where organizations can assign unique IDs to known vulnerabilities. These IDs, formatted as "CVE" followed by a year and a number (e.g., CVE-2022-27254), enable security professionals to keep tabs on vulnerabilities that could affect everyday devices and critical systems.

Global Impact of CVE Funding Shortfall

Security and privacy researcher Lukasz Olejnik took to X to express his concerns, warning that without continued support, the CVE system could "cripple" global cybersecurity efforts. He emphasized that the absence of CVE could lead to a breakdown in coordination among vendors, analysts, and defense systems, resulting in widespread confusion and a significant weakening of cybersecurity measures.

Despite the looming deadline, Yosry Barsoum, MITRE's vice president and director at the Center for Securing the Homeland, remains optimistic. In an emailed statement to *The Verge*, Barsoum noted that the government is actively working to sustain MITRE's role in the program, and MITRE is committed to maintaining CVE as a global resource. He also mentioned that the funding change could impact the related Common Weakness Enumeration program, which focuses on cataloging hardware and software weaknesses.

Leaked Documents and Official Statements

The urgency of the situation came to light through a leaked letter to CVE board members, which was shared on social platforms X and Bluesky. MITRE, which receives its funding from the US Department of Homeland Security (DHS) and the Cybersecurity and Infrastructure Security Agency (CISA), is tasked with operating and advancing the CVE Program as an independent, objective third party, as outlined in an official video about the program.

The potential discontinuation of funding for the CVE program is a stark reminder of the fragile nature of cybersecurity infrastructure. As the deadline approaches, the tech community and security professionals worldwide are watching closely, hoping for a resolution that will keep this essential tool operational.