The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has extended its contract with MITRE Corporation, ensuring the uninterrupted operation of the Common Vulnerabilities and Exposures (CVE) program, a cornerstone of global cybersecurity that was hours away from losing federal funding. “If a break in service were to occur, we anticipate multiple impacts to CVE, including deterioration of national vulnerability databases and advisories, tool vendors, incident response operations, and all manner of critical infrastructure,” cautioned Yosry Barsoum, MITRE’s Vice President and Director of the Center for Securing the Homeland. For now, the extension means that security professionals, vendors, and government agencies worldwide can continue to rely on the CVE program for coordinated vulnerability tracking and response. A CISA spokesperson said to Cyber Security News “The CVE Program is invaluable to the cyber community and a priority of CISA. Experts warned that a shutdown would disrupt national vulnerability databases, degrade security advisories, and hamper the efforts of tool vendors and incident responders worldwide. The crisis unfolded as MITRE confirmed that its contract with the U.S. Department of Homeland Security (DHS) to operate the CVE program would expire on April 16, 2025, with no renewal in place. CISA, the primary sponsor of the CVE program, responded to mounting pressure and industry appeals by executing an “option period” on the contract late Tuesday night, just hours before the program was set to lapse. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The CVE program, established in 1999 and maintained by MITRE, provides the world’s most widely used system for cataloging and standardizing identifiers for publicly disclosed cybersecurity vulnerabilities. Its unique identifiers, known as CVE IDs, are essential for security researchers, vendors, and IT teams to track, prioritize, and remediate security flaws efficiently. The database underpins everything from vulnerability scanners and patch management systems to incident response operations and critical infrastructure protection.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 16 Apr 2025 14:05:27 +0000