Future of CVE repository in doubt as MITRE contract ends

Uncertainty is mounting in the cybersecurity sector following reports that MITRE's decades-old contract to support the Common Vulnerabilities and Exposures (CVE) repository is set to expire, raising concerns among professionals about the future of this critical infrastructure. The CVE program, launched in 1999, has become the backbone of vulnerability identification and response globally, cataloguing over 250,000 unique CVEs to date.

Cybersecurity professionals warn of significant disruption if MITRE's role in administering the CVE repository and related programmes comes to an end.

"A network is only as secure as the known vulnerabilities that have been patched. Given that our nation's critical infrastructure is operating under heavy reliance on the CVE repository to discover and resolve reported vulnerabilities, this transition will surely cause major gaps to their level of security," said Debbie Gordon, CEO and Founder of Cloud Range.

She underscored the heightened risk at a time when cyber threats continue to evolve and proliferate. "In these times of constant cyber threats, organisations will now need to increase their levels of visibility and awareness, and their defence teams need to have even greater critical thinking and situational awareness to detect and respond to threats."

The uncertainty stems from news that funding for MITRE's stewardship of the CVE Programme may lapse, with no clear successor or replacement framework in place. This ambiguity is amplifying industry anxiety. Satnam Narang, Senior Staff Research Engineer at Tenable, observed, "The lack of certainty surrounding the future of the CVE program creates great uncertainty about how newly discovered vulnerabilities will be catalogued."

He highlighted the program's foundational role: "CVE is the language of vulnerabilities and exposures, so without it, we do not know what might take its place. There may be several competing solutions, but unless one emerges as the frontrunner, we may end up with a situation like we have with the naming of threat actors where there is no uniformity in names."

This fragmentation, Narang warned, risks undermining the seamless and systematic tracking of vulnerabilities across products and services. The centralised CVE repository provides a common taxonomy that allows defenders to communicate and collaborate efficiently, accelerating the response to cybersecurity threats.

The short-term contingency involves CVE Numbering Authorities (CNAs)—organisations authorised to reserve and assign CVE identifiers. "While CNAs can reserve CVEs, the sheer volume of CVEs means that there's only a really small window of time before those CVE identifiers run out," Narang added. Without central coordination, the proliferation of disparate vulnerability tracking methods could erode the collective defence posture of both public and private sectors.

Losing the CVE's centralised assignment and tracking could potentially push organisations to adopt vendor-specific or competing standards, increasing complexity and the possibility of missed security gaps. "We're continuing to monitor the developments around the planned expiration of funding," Narang concluded, echoing industry-wide watchfulness.

For now, cybersecurity leaders are calling on governments and private industry stakeholders to prioritise finding a solution. The CVE repository has long enabled timely disclosure and remediation of security flaws. Its uncertain future raises the risk that vulnerabilities might go undiscovered or unremediated for longer periods, elevating threats to critical national infrastructure and enterprise systems alike. With the digital economy's ongoing reliance on robust cybersecurity infrastructures, a gap in CVE administration represents not only an operational risk but also a national security concern.

As discussions continue, industry voices urge transparency, swift action, and a clear path forward to ensure the continuity of the global standard for vulnerability management.