Conversation

shellsharks All Content shellsharks All Content remote Jul 31, 2026, 1:18 PM You are here

The Death of CVE
The CVE program is dying. Damn. 1

What does this mean? What were CVEs (Common Vulnerabilities and Exposures) doin’ for us anyway? Are CVEs considered critical cybersecurity infrastructure? What are we gunna’ do now?! Panic!! Read on for more hyper-composed and ever-well-researched analysis! (Plus, plenty of related resources, per usual.)
Disclaimer: It's more than likely I get something wrong in the analysis below. The situation is also very rapidly evolving. This is just my hot take on everything, and my perspective as someone who worked in the VM field for quite some time. Feel free to message me with any corrections! I reserve the right, and almost certainly will, return to this post and update it as I learn more. This is but a jumping off point!
What is CVE All About?

OK, a quick primer on the CVE program—from CVE.org…

The mission of the CVE® Program is to identify, define, and catalog publicly disclosed cybersecurity vulnerabilities.

Here’s an example of a single CVE record (for CVE-2014-6271, a.k.a. “ShellShock”)…

As you can see, CVE records contain a wealth of data for known vulnerabilities: publish dates, descriptions, product status(es), references to supporting materials, exploit PoC’s, and more. The idea is to have a CVE record for any and all CVEs under the sun. Useful yeah? That’s about all I’ll cover about what the CVE program is here. For more info, just go check out cve.org (or some of the other resources if / when cve.org dies 💀).

CVE in Practice

So, how are CVEs used by the larger infosec industry? In many more ways than I’ll likely be able to cover here, but I want to touch on a few ways this information is embedded. Namely, in terms of vulnerability management and vulnerability scan-related operations.

Here’s some basics on how CVE data makes it’s way to you, the infosec populace.
1. Vendor releases crappy insecure software.
2. Vulnerabilty Researcher identifies vulnerabilities in said software and discloses it to vendor.
3. Vendors (often acting as official CNAs) assign CVE IDs to vulnerabilities and publish CVE records.
4. CVE.org aggregates and publishes vulnerability records via a centralized database.
5. Consumers of this data ingest newly published vulnerability records. (e.g. network/endpoint scanning vendors)
6. Corporate IT Security teams run said scanning tools.
7. Along the way, CVE Working Groups help improve CVE-related processes.
To put simply, scanning tools are able to identify vulnerabilities because CVE records contain valuable software and version information. These tools can compare known versions of installed software with the database of vulnerabilities that tell us what sofware+versions are affected / vulnerable. So, without CVE data, vulnerability scanning fidelity craters.

There is a lot of other infosec / vulnerability-related infrastructure that relies on the CVE program as a dependency. CISA’s KEV is one example. I’ve got to think that many threat intelligence sources also leverage a lot of CVE data too.

None of this sounds great so far. So what’s next?

Now What?

Well, first of all, CVE is pretty important for a lot of things, so it looks like CISA has found a way to keep it afloat for now. 1

There’s a lot of potential scenarios whereby CVE as we know it today just sticks around and keeps hummin’ along as it has. The government could come to its senses (lol), or it could find funding elsewhere. I don’t know how much it costs to run that whole operation, but it can’t be much compared to the revenue some of these companies that rely on it bring in.

Some have started to argue that the loss of CVE could actually help the industry, and that the CVE model had run its natural course. Maybe they’re right?

Even if CVE as we know it today keeps on keepin’ on, this should be a wakeup call for the world, and for IT and IT-security programs. What would it mean to have CVE vanish overnight? As it seemingly almost did. Would this mean the death of Vulnerability Management entirely? I don’t think so. Would it mean that vulnerability scanners would be completely dead in the water? Not exactly. Would we have any actionable vulnerability intelligence data without CVE? I believe so. Would this cripple the infosec industry? Nah. It’d be a gut punch for sure, but there’s some resiliency in play. Let me talk a bit about how VM programs and the larger scanning industry would need to adapt…

The CVE program has done a lot to get us where we are, but I believe a lot of this infrastructure stays in-place regardless of what happens to cve.org itself. Vulnerability researchers are not staffed out of cve.org. So research can continue on as it always has. The vendors to which these researchers disclose vulnerabilities to also are unaffected. So vendors can continue to receive vuln disclosures and publish vulnerability data via their disclosure portals as they have been doing. The difference now is that there is no centralized repo by which all of these disparate vulnerability repos will be ingested. We can adapt to that it seems right? Scan vendors can go directly to these companies sites and pull vuln data in, and VM teams across the world can do the same. Not to trivialize the work it would take to fetch data in a decentralized manner, and then normalize all that data—but it’s all there!

We as an industry may want to evaluate how hard-coded CVE data is into our regular operations, but I think we’d be fine without it in the worst case scenario. Hell, lessening our reliance on CVE could actually help improve security in some ways if it meant doing less “baseline” security and more critical thinking 🤔.

Alternative Funding

In light of the precacious funding situation of the CVE program, here’s some ideas on how else it could be funded…
- The CVE Foundation was just launched to “Secure the Future of the CVE Program”. It was founded by a coalition of CVE Board members. More to come from them…
- Given how many vulnerabilities are present in Adobe, Oracle and Microsoft products, maybe they should help support CVE! 😅
- So much of the infosec vendor industry is reliant on CVE. It seems like they could put their heads (and wallets) together to help sustain CVE. Looking at you Tenable, Qualys, Rapid7, et al. 👀
- Other governments have already started to step up to fill the gap. Check out ENISA.
Vulnerabilty Catalogs

I’ve long maintained a comprehensive list of Vulnerability Catalogs. Not all of these are one-for-one replacements for CVE.org, but it goes to show that vulnerability intelligence would still exist and other vulnerability databases are there to pick up the slack.

Other Questions

Some other related questions pertaining to this whole CVE potentially going-away debacle…
- The suddenness of this whole situation is quite alarming. Given the importance of CVE, how was it that alarm bells only started going off literally the day before the entire site would have been shut down? I know things are crazy and volatiile in the government funding world right now, but yikes.
- The extended funding is from CISA. The same CISA that has been under threat by the current administration. What’s to stop this same admin from pulling CISA funding or otherwise undercutting this latest effort to keep CVE on life support?
Memes

The hottest CVE meltdown memes, collected and made available here for you.
News

Journalist and news organization publications:
Resources

Other resources, posts, discussion and info related to this whole mess.
1. No lapse in critical CVE services ↩ ↩2
source

Conversation

The Death of CVE

What is CVE All About?

CVE in Practice

Now What?

Alternative Funding

Vulnerabilty Catalogs

Other Questions

Memes

News

Resources