The Critical Impact of MITRE’s CVE Funding Expiration and Mitigation Strategies

Introduction

On April 16, 2025, the U.S. government funding for MITRE to operate and maintain the Common Vulnerabilities and Exposures (CVE) program expired, creating a potential crisis in the global cybersecurity ecosystem. This report analyzes the far-reaching consequences of this development and explores strategies to mitigate its impact.

Understanding the CVE Program and Current Situation

The 25-year-old CVE program has served as a foundational pillar of cybersecurity since 1999, providing a standardized system for identifying, defining, and cataloging publicly disclosed security vulnerabilities using unique CVE IDs. With over 274,000 CVE records to date, this system has become the de facto standard for vulnerability management worldwide.

The program has been run by MITRE with sponsorship from the U.S. Department of Homeland Security (DHS) and the Cybersecurity and Infrastructure Security Agency (CISA). However, as of April 16, 2025, the “current contracting pathway for MITRE to develop, operate, and modernize CVE and several other related programs, such as the Common Weakness Enumeration (CWE), will expire”.

CISA has acknowledged the situation, stating, “Although CISA’s contract with the MITRE Corporation will lapse after April 16, we are urgently working to mitigate impact and to maintain CVE services on which global stakeholders rely”. The agency declined to explain why the contract was not renewed, though some sources suggest it may be related to broader government budget cuts.

Immediate and Long-term Impacts

Disruption to Vulnerability Tracking and Management

The expiration of funding creates an unprecedented situation where no new CVEs will be added to the program after April 16, though historical CVE records will remain available on GitHub. This disruption affects the entire vulnerability management ecosystem that has been built around the CVE standard over the past two decades.

Yosry Barsoum, MITRE’s vice president, warned that a break in service would cause “multiple impacts to CVE, including deterioration of national vulnerability databases and advisories, tool vendors, incident response operations, and all manner of critical infrastructure”.

Loss of Standardized Communication

Without CVEs as a unified framework, security professionals face significant challenges in communicating about vulnerabilities. Greg Anderson, CEO of DefectDojo, illustrated this problem: “If a new encryption vulnerability emerges across the internet, one organization might label it ‘The worst encryption flaw ever,’ while another might call it ‘A terrible encryption flaw,’ both neglecting the CVE-20XX-XXXX identification system. Without CVEs, how can we be certain we’re discussing the same issue?”

This loss of standardized terminology has been likened to “the abrupt removal of all dictionaries”, emphasizing how fundamental this system is to effective cybersecurity communication.

Impact on Security Tools and Processes

Numerous tools and processes that depend on current CVE data – including vulnerability scanners, patch management systems, and threat intelligence feeds – will be affected. Many security vendors integrate CVE data into their products, and security teams use CVEs to track risks and drive remediation efforts.

Dustin Childs, head of threat awareness at Trend Micro’s Zero Day Initiative, described the potential consequences as “disastrous,” noting that before the CVE database, there was a “confusing array of different technical terms and classifications”.

Global Cybersecurity Coordination Challenges

Security researcher Lukasz Olejnik warned that the absence of CVE support could “cripple” global cybersecurity frameworks, leading to a “disintegration of coordination among researchers, analysts and defenders—no one will be sure they are discussing the same vulnerability.” He predicted “total chaos and a sudden decline in cybersecurity overall”.

Mitigation Strategies

Government Efforts

CISA has stated they are “urgently working to mitigate impact and to maintain CVE services”. The government continues to make “considerable efforts” to support MITRE’s role in the program, though no resolution has been announced as of the funding expiration date.

Industry Initiatives

The cybersecurity industry has begun taking proactive steps to fill the gap. VulnCheck, for example, has “proactively reserved 1,000 CVEs for 2025” and committed to continue providing CVE assignments to the community. Patrick Garrity from VulnCheck explained, “We can assign a CVE to vulnerabilities for 1-2 months as long as the core service continues”.

Other security companies are emphasizing their independence from the CVE program. Tenable noted that they develop their “vulnerability coverage against vendor advisories directly, and will continue to do so, so long as vendors make those advisories available whether they contain CVE identifiers or not”. As a CVE Numbering Authority (CNA), Tenable has also “reserved a large number of CVE designators for disclosures”.

Leveraging Existing Resources

Although the active assignment of new CVEs may be paused, historical CVE records will continue to be available on GitHub, providing some continuity for existing vulnerabilities. However, this only preserves the functionality of the program for a limited time, as new vulnerabilities continue to emerge.

Alternative Approaches

In the absence of a coordinated CVE program, security teams may need to develop alternative approaches for tracking and communicating about vulnerabilities. This could include:

1. Relying more heavily on vendor-specific advisories and identifiers

2. Developing industry-specific vulnerability tracking systems

3. Creating temporary coordination mechanisms among major security vendors

Recommendations for Organizations

Short-term Actions

1. Monitor developments closely: Keep track of announcements from CISA, MITRE, and major security vendors regarding the status of the CVE program.

2. Inventory security tools that depend on CVE data: Understand which of your security tools and processes rely on CVE information and assess potential impacts.

3. Establish alternative communication protocols: Develop internal guidelines for how your security team will communicate about new vulnerabilities in the absence of CVE IDs.

4. Engage with security vendors: Contact your security vendors to understand their plans for handling vulnerability information without new CVEs.

Medium-term Strategies

1. Support industry initiatives: Consider participating in or supporting industry efforts to maintain vulnerability tracking standards.

2. Diversify vulnerability information sources: Expand beyond CVE-dependent sources to include vendor advisories and other vulnerability databases.

3. Enhance internal vulnerability management processes: Strengthen your organization’s ability to identify, track, and remediate vulnerabilities independently of external numbering systems.

Conclusion

The expiration of funding for MITRE’s CVE program represents a significant disruption to the global cybersecurity ecosystem. While historical CVE records will remain available, the lack of new CVE assignments threatens to fragment communication about vulnerabilities and undermine coordinated response efforts.

Both government agencies and private industry are working to mitigate the impact, but organizations should prepare for potential disruptions by diversifying their vulnerability information sources and strengthening internal vulnerability management processes. The situation also highlights the need for sustainable funding models for critical cybersecurity infrastructure that can withstand government budget fluctuations.

As the situation evolves, continued collaboration across the cybersecurity community will be essential to maintaining effective vulnerability management practices even in the absence of the centralized CVE program.