The CVE Program's Funding Scare and What It Means for Vulnerability Management
A near-lapse in the CVE program's federal funding in 2025 was a real wake-up call about how much of global vulnerability management runs on a single point of failure.
The CVE (Common Vulnerabilities and Exposures) program — the shared numbering and cataloging system nearly every vulnerability scanner, SBOM tool, and patch-management process depends on — is funded through a contract between MITRE and CISA. In 2025, that funding came close to lapsing before a short-term extension was arranged, a real moment that made visible just how much of the global vulnerability-management ecosystem depends on a single federally-funded program continuing to exist.
Why it matters even though the immediate lapse was averted
Vulnerability scanners, SBOM tooling, patch prioritization, and a large share of regulatory vulnerability-disclosure requirements all reference CVE IDs as the common language. A sustained disruption wouldn't stop vulnerabilities from existing — it would break the shared vocabulary the entire industry uses to talk about and prioritize them.