The Cybersecurity and Infrastructure Security Agency said it reached an agreement to renew funding for a software vulnerability program that is used by the information security community to address security flaws.
The funding will be restored for a period of 11 months, according to officials familiar with the decision.
Mitre Corp. on Tuesday had warned that funding to operate the Common Vulnerabilities and Exposures program would expire as of today. The government-funded program has been a critical part of how the cybersecurity community keeps track of software flaws that are at risk of being exploited by adversaries, including criminal and state-linked threat groups.
The lapse was previously disclosed Tuesday in a letter to CVE board members and later confirmed to Cybersecurity Dive in a statement from Yosry Barsoum, vice president and director of the Center for Securing the Homeland.
"On Wednesday, April 16, 2025, funding for Mitre to develop, operate, and modernize the Common Vulnerabilities and Exposures Program and related programs, such as the Common Weakness Enumeration Program, will expire,” Barsoum said in the statement before the funding agreement was reached. “The government continues to make considerable efforts to support MITRE's role in the program and MITRE remains committed to CVE as a global resource."
The software industry rose up in protest Tuesday, fearing the funding expiration would potentially cripple a process that has already been dealing with a massive backlog of vulnerabilities that have yet to be properly analyzed and remediated.
“The CVE Program is invaluable to the cyber community and a priority of CISA,” a CISA spokesperson told Cybersecurity Dive via email Wednesday. “Last night, CISA executed the option period on the contract to ensure there will be no lapse in critical CVE services.”
Information security experts had warned Tuesday that a lapse in funding could have resulted in massive delays in vulnerability disclosures and left open a wide window for exploitation of software flaws.
“This would delay vulnerability disclosures and affect coordinated disclosure timelines,” said Tim Peck, senior threat researcher at Securonix. “Notes on patching and remediations could be delayed offering a greater window of time to attackers to engage in exploitation.”
It’s unclear what specifically took place between the original warning about the funding lapse from Mitre and CISA’s decision to restore the funding.
