CVE’s Future Has Been in Doubt Since the Trump Administration Nearly Axed It
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently published a concise whitepaper outlining four “dimensions of quality” that it aims to pursue in order to enhance the Common Vulnerabilities and Exposures (CVE) program. This program, overseen by CISA, catalogs and characterizes newly discovered software vulnerabilities, making it a critical component of cybersecurity infrastructure.
The CVE program is held in high regard globally, considered one of the most trusted and utilized public goods in cybersecurity. Its influence extends to cyber defenders worldwide, who rely on it for effective vulnerability management and prioritization. As such, the future of the CVE program holds significant implications for the expansive ecosystem of cybersecurity vendors that have emerged around the processes of vulnerability prioritization and management.
However, doubts about the program’s continued viability began to surface during the early months of the Trump administration. The administration’s cost-cutting measures nearly resulted in the termination of a crucial government contract with Mitre, the public-private institution responsible for the maintenance and management of the CVE program. This uncertainty has lingered over the CVE program ever since.
The urgency surrounding the CVE program has intensified in light of recent developments referred to as the “vulnpocalypse,” an era driven by artificial intelligence that has seen a pronounced increase in the identification of software vulnerabilities. Current forecasts suggest that the number of recognized CVEs could reach an astonishing 96,000 this year alone. This figure would represent nearly a quarter of the total 396,869 vulnerabilities that have been reported since the program’s inception in September 1999.
CISA’s latest short whitepaper acknowledges this challenge and aims to address the substantial volume of new vulnerabilities entering the system. Katie Moussouris, CEO of Luta Security and a recognized pioneer in vulnerability research, expressed optimism over the publication. She highlighted the agency’s commitment to maintaining the integrity of the CVE program. However, Moussouris emphasized a critical resource challenge, noting that CISA has experienced significant resource cuts in recent years:
“It’s important that the necessary resources are made available to manage the growing responsibilities of the CVE program,” Moussouris stated. Despite the omission of specific details regarding resources in the whitepaper, she expressed confidence that CISA is making a case for the resources required to meet its obligations.
Conversely, other experts have voiced concerns regarding the lack of urgency and the necessity for a more innovative approach to addressing these challenges. Adrian Sanabria, founder of the Defenders Initiative—a firm dedicated to original research on vulnerability management—wrote critically about the whitepaper’s content. He lamented that it lacked specificity on new initiatives, remarking, “It’s disappointing that the publication mostly reiterates existing practices instead of proposing radical changes.”
Sanabria raised essential points about the need for better management of vulnerability data, particularly when it comes to “enrichment,” a process that currently enriches only 1-in-5 vulnerabilities. The enrichment process is vital for assigning a Common Vulnerability Severity Score, a key component that many vulnerability management platforms rely on for their operations. He urged the authors of the whitepaper to focus on how to improve this aspect of the program, noting the current confusion that arises when multiple organizations assign different scores to identical vulnerabilities.
Beneath these technical concerns lies the critical question of maintaining consistency across an expanding ecosystem. According to Sanabria, inconsistencies in vulnerability scores can lead to confusion among cybersecurity professionals tasked with managing these risks. With Europe also entering the CVE landscape, the situation calls for enhanced collaboration and standardization to streamline how vulnerabilities are scored globally.
The four-page whitepaper represents CISA’s continuing efforts to usher the CVE program into what it describes as its “quality era.” This focus aims to ensure attributes such as reliability, responsiveness, and improved data quality for vulnerabilities. The four identified dimensions of quality include program governance, ecosystem participation, data infrastructure, and CVE record content, with the agency striving to strengthen its framework in these essential areas.