Inspector General Finds NIST Mismanaged the National Vulnerability Database
Summary
A Commerce inspector general report found NIST’s NVD backlog grew to over 27,000 unprocessed vulnerabilities amid planning failures, inefficient enrichment and duplicated work with CISA. NIST agreed to six recommendations.
Key points
- The NVD backlog grew from about 13,000 unprocessed vulnerabilities in June 2024 to over 27,000 by the end of 2025.
- The report found NIST analysts spent about 80% of their time calculating severity scores and identifying affected products; tested scores matched independent evaluators only 12% of the time.
- The report identified at least 21,000 cases of duplicated work between NIST and CISA’s Vulnrichment program from May 2024 through December 2025, with about $200,000 in estimated waste.
- Manual identification of affected products remains a significant bottleneck, though NIST is developing tools to speed the work.
- The inspector general made six recommendations, including long-term planning, backlog goals, improved coordination with CISA and better communication with users.
- NIST agreed with all six recommendations and must submit a plan for addressing them by late July.
Article Details
- Event Type
- Department of Commerce inspector general audit found mismanagement of NIST’s National Vulnerability Database (NVD), including poor planning, inefficient enrichment work, duplication with CISA, and inadequate communication with users.
- Impact
- The NVD backlog grew from about 13,000 unprocessed vulnerabilities in June 2024 to more than 27,000 by the end of 2025. The audit found severity scores matched independent evaluators only 12% of the time and identified at least 21,000 duplicated work cases between NIST and CISA from May 2024 to December 2025, with approximately $200,000 wasted. NIST agreed with all six recommendations and must submit an implementation plan by late July.
Products
CISA Known Exploited Vulnerabilities (KEV) Catalogannounced that it has narrowed its priorities for the NVD, focusing only on vulnerabilities in CISA’s KEV catalog, software used by the federal government, and critical software identified under Executive Order 14028.Common Vulnerabilities and Exposures (CVE) listA similar program that serves as a catalog of known security flaws, the Common Vulnerabilities and Exposures (CVE) list, has had similar issues over the past few years.National Vulnerability DatabaseA Department of Commerce inspector general report says NIST has mismanaged the National Vulnerability Database through poor planning, inefficient enrichment work, duplicated efforts with CISA, and weak communicationVulnrichmentCISA’s Vulnrichment program duplicated work done by NIST analysts.