The worldwide cybersecurity alert system is failing.
Sure! Here’s a rewritten version of the content with promotional call-to-actions removed or rephrased:
—
Cybersecurity practitioners have flooded Discord channels and LinkedIn feeds with emergency posts and memes depicting “NVD” and “CVE” engraved on tombstones. Unpatched vulnerabilities rank as the second most common method cyberattackers use to gain access, resulting in severe hospital outages and failures in critical infrastructure. Jen Easterly, a US cybersecurity expert, stated in a social media post: “Losing [CVE] would be like tearing out the card catalog from every library at once—leaving defenders to sort through chaos while attackers take full advantage.” If CVEs identify each vulnerability like books in a card catalog, NVD entries provide detailed reviews with context regarding severity, scope, and exploitability.
Recently, the Cybersecurity and Infrastructure Security Agency (CISA) extended funding for CVE for another year, attributing the incident to a “contract administration issue.” However, the situation with the NVD has proven more complex. Its parent organization, the National Institute of Standards and Technology (NIST), has reportedly faced a budget cut of roughly 12% in 2024, coinciding with CISA’s withdrawal of its $3.7 million in annual funding for the NVD. As the backlog of vulnerabilities increased, CISA launched its own “Vulnrichment” program to address the analysis gap and promote a distributed approach that allows multiple authorized partners to publish enriched data.
“CISA continuously assesses how to most effectively allocate limited resources to help organizations reduce the risk of newly disclosed vulnerabilities,” says Sandy Radesky, the agency’s associate director for vulnerability management. She emphasizes that Vulnrichment was initiated to provide unique additional information, such as recommended actions for specific stakeholders, and to “reduce the dependency on the federal government’s role as the sole provider of vulnerability enrichment.”
Meanwhile, NIST has been working to hire contractors to help clear the backlog. Although processing levels have returned to pre-crisis conditions, the surge in vulnerabilities disclosed to the NVD has outpaced these efforts. Currently, over 25,000 vulnerabilities are pending processing—nearly ten times the previous high noted in 2017, according to data from a software company. Previously, the NVD managed to keep pace with CVE publications and maintained a minimal backlog.
“Things have been disruptive, and we’ve been going through a period of change across the board,” stated Matthew Scholl, former chief of the computer security division in NIST’s Information Technology Laboratory, at an industry event in April. “Leadership has assured me and everyone that NVD is and will continue to be a mission priority for NIST, both in resourcing and capabilities.” Scholl left NIST in May after two decades at the agency, and NIST declined to comment on the backlog.
This situation has spurred multiple government actions, with the Department of Commerce initiating an audit of the NVD in May and House Democrats calling for a broader investigation of both programs in June. The impact on trust is already altering geopolitics and supply chains as security teams gear up for a new era of cyber risk. “It’s left a bad taste, and people are realizing they can’t rely on this,” says Rose Gupta, who develops and manages enterprise vulnerability management programs. “Even if they manage to resolve everything with a larger budget, I have concerns that this won’t happen again. Therefore, I need to ensure I have additional controls in place.”
As public resources struggle, organizations and governments are facing a critical vulnerability in our digital infrastructure: essential global cybersecurity services are dependent on a complex network of US agency interests and government funding that can be cut or redirected at any moment.
What began as a trickle of software vulnerabilities in the early Internet era has become an overwhelming flood, and the free databases that have tracked them for decades are finding it increasingly challenging to keep up. By early July, the CVE database surpassed 300,000 cataloged vulnerabilities. The numbers fluctuate unpredictably each year, sometimes increasing by 10% or even more. Even before its latest challenges, the NVD was known for delayed publication of new vulnerability analyses, often lagging behind private security software and vendor advisories by weeks or months.
