If the CVE program stopped issuing identifiers, vulnerabilities would still be found and fixed. Vendors, researchers and other databases would keep publishing, but matching, tooling and reporting would get messier. Prepare by diversifying advisory sources, keeping a precise inventory and not letting your process depend on one identifier.
This is a calm what-if. No stop is announced or predicted here, and we assert no dates.
Why is the question being asked?
In April 2025 the program's contract future became public. CISA's statement says that on 15 April 2025 CISA executed the option period on the contract, to ensure there would be no lapse in critical CVE services, and that it released its statement on 16 April. CISA called the program invaluable to the cyber community and a priority.
The CVE Foundation's site describes its aim as supporting the transition of the program from a single funding stream to a diversified and stable funding model. We could not retrieve the CVE.org site itself because it needs JavaScript, so check it directly for the current state of the program.
Those two facts are enough to justify a plan. They do not mean anything is ending.
What would actually break?
CVE identifiers are a shared label. Many things hang off them: scanner matching, SBOM and VEX records, ticket titles, customer questionnaires, regulatory reporting and the CISA Known Exploited Vulnerabilities catalog, whose entries are keyed by CVE.
Without new identifiers, a flaw could still be described in a vendor advisory or a repository's own database, but different tools might name it differently or miss it. Dedupe gets harder. Reports to customers become awkward when each source uses its own id.
What would not break: your ability to know which components you run. That part is yours.
What should you prepare?
Inventory. If you know exactly which packages and versions are deployed, you can match against any advisory source. An SBOM per build is the base. CISA describes an SBOM as a nested inventory of the ingredients in software components.
Multiple sources. Subscribe to vendor advisories, ecosystem advisory feeds and your scanner's own data, not only one national list. Check which of your tools can match on package identifiers, not only on CVE ids.
Neutral internal ids. Give every finding your own id and store external ids as attributes. If the label changes, your tickets and history stay intact.
Process independence. Define triage rules by exploitation evidence, exposure and reachability, not by the presence of a CVE number. The KEV catalog and the FIRST EPSS scores are examples of signals you can still use, so long as you know how they key their data.
Communication. Prepare a short template for telling customers about a flaw with no identifier yet: affected product and versions, impact, mitigation and the source.
How do you test readiness?
Run a drill. Pick a recent real vulnerability and pretend it has no CVE. Can you find affected systems from advisory text alone? Can you open a ticket, notify owners and report to a customer? Where did the process stall?
What to do
- Generate and store an SBOM for every release you ship and every system you run.
- List the advisory sources each of your scanners uses, and add at least two independent ones.
- Add an internal finding id and store external ids as fields.
- Rewrite triage rules to use exploitation signals, exposure and reachability.
- Check that your tools can match by package identifier as well as by CVE id.
- Draft the customer communication template.
- Run the no-identifier drill and record fixes.
- Re-check the program's status on CVE.org and CISA each quarter.
Quick check
Has the CVE program stopped?
Not according to the sources we read. CISA said it extended the contract in April 2025, and this post is a preparedness exercise only.
What is the most useful single preparation?
An accurate inventory of what you run, which lets you match any advisory source.
Sources
- CISA Statement on the CVE Program, April 2025, fetched 18 October 2026
- CVE Foundation, fetched 18 October 2026
- Software Bill of Materials (SBOM), CISA, fetched 18 October 2026
- Known Exploited Vulnerabilities Catalog, CISA, fetched 18 October 2026
- Exploit Prediction Scoring System (EPSS), FIRST, fetched 18 October 2026
Last reviewed: 18 October 2026.
