Many in the cybersecurity community expressed alarm on Tuesday following a letter from Yosry Barsoum, MITRE’s vice president and director of the Center for Securing the Homeland, which warned that funding for the CVE program was expiring and the federal government appeared to have no intention to renew the contract. The MITRE Corporation will continue operating the CVE program for at least another 11 months after federal cybersecurity officials confirmed that they temporarily extended their contract with the organization to keep the platform running. A MITRE spokesperson told Recorded Future News that were the contract to lapse, no new CVEs would be added to the program and the CVE program website online would eventually cease. The CVE program — which stands for Common Vulnerabilities and Exposures — is a foundational pillar of the cybersecurity system that countless cybersecurity vendors, governments and critical infrastructure organizations rely on for vulnerability identification. While this structure has supported the program's growth, it has also raised longstanding concerns among members of the CVE Board about the sustainability and neutrality of a globally relied-upon resource being tied to a single government sponsor,” the organization said. Federal contract documents show that CISA’s $57.8 million contract with MITRE expired on Wednesday but had an option to continue until March 16, 2026.
This Cyber News was published on therecord.media. Publication date: Wed, 16 Apr 2025 16:30:19 +0000