The Week the CVE Program Almost Lapsed
On April 15, a letter from MITRE began circulating: the contract that funds the CVE program was due to expire the next day. For a little under 24 hours, the security industry contemplated a world without a central authority assigning identifiers to vulnerabilities. Late on April 16, CISA said it had executed an option to extend the contract. A group of CVE board members announced a new nonprofit, the CVE Foundation, to pursue a more independent long-term structure.
The immediate crisis passed. The dependency it revealed didn’t.
How much rests on one identifier
Most vulnerability programs assume, usually without writing it down, that every flaw worth fixing will have a CVE identifier, and that the identifier will soon be enriched with a severity score and affected product data. Scanners match on CVE IDs. Ticketing rules route on CVSS scores. Service-level targets are set by severity band. Vendor advisories, threat intelligence and KEV entries all reference the same identifiers.
The program had already shown strain before this month. The National Vulnerability Database, which enriches CVE records with scores and product data, has carried a large analysis backlog since early 2024. Many organizations noticed only when their scanners began reporting new CVEs with no severity attached.
A lapse in CVE assignment would have compounded that problem, and it would have been far more visible.
What a resilient program looks like
CVE remains the backbone. The aim is a program whose prioritization still works when any single upstream source is slow, incomplete or unavailable.
Track vendor advisories directly for critical technology. For the products that matter most, particularly internet-facing infrastructure, subscribe to vendor security advisories and treat them as primary sources. Many vendors publish advisories with their own identifiers before, or instead of, a CVE record.
Use more than one signal of exploitation. CISA’s KEV catalog, vendor statements of in-the-wild exploitation, and exploit prediction scores such as EPSS each answer a slightly different question. Together they’re far more useful than CVSS alone, and none depends on NVD enrichment.
Score what you can’t look up. When a finding arrives without a score, the program should have a rule other than “wait”. A simple internal triage that considers exposure (is it internet-facing?), asset importance and evidence of exploitation will sort most findings sensibly.
Know your own assets well enough to match without perfect data. If product and version data for your estate is accurate, you can match an advisory to affected systems yourself. Organizations that rely on the scanner to do that matching are the most exposed to upstream gaps.
Write down the dependency. List the external data sources your vulnerability process relies on, what each provides, and what you’d do if it stopped. Most programs have never done this. It takes an afternoon and will likely surprise someone.
A test worth running
Pick a recent critical advisory for a product you run. Pretend there’s no CVE record and no score. How long would it take your team to determine whether you’re affected, how exposed you are, and what to do first?
If the answer is “about the same”, your program is in good shape. If the honest answer is that nothing would happen until the scanner caught up, that’s the gap to close this year.
Looking ahead
The CVE contract extension runs into 2026, and the governance discussion is now public. Other efforts, including European vulnerability database work under ENISA, may give the ecosystem more than one source of record over time. That’s healthy. In the meantime, the organizations best placed to handle disruption are those whose prioritization depends on their own understanding of their environment, with external data as an input rather than a precondition.