NIST to Stop Scoring Lower-Priority CVEs in NVD Starting April 15
Summary
Starting April 15, NIST will prioritize NVD enrichment for CVEs tied to CISA’s KEV, U.S. federal software, or critical software under EO 14028. Other CVEs will remain listed but marked “Not Scheduled.”
Key points
- NIST will stop assigning severity scores and providing additional enrichment for lower-priority CVEs starting April 15.
- Prioritized CVEs include those in CISA’s Known Exploited Vulnerabilities catalog, affecting U.S. federal software, or involving critical software under Executive Order 14028.
- All submitted CVEs will remain in the NVD; entries not selected for enrichment will be marked “Not Scheduled” and rely on CNA-provided ratings.
- NIST cited a 263% increase in submissions and said it enriched 42,000 CVEs in 2025.
- NIST will accept requests to enrich lower-priority CVEs at [email protected].
Article Details
- Event Type
- NIST policy change to prioritize vulnerability enrichment in the National Vulnerability Database (NVD)
- Impact
- Beginning April 15, NIST will provide severity scores and additional analysis only for CVEs meeting its risk-based criteria, including inclusion in CISA’s KEV catalog, impact on U.S. federal software, or designation as critical under Executive Order 14028. Other CVEs will remain listed in the NVD as “Not Scheduled” and will rely on ratings from the submitting CNA. NIST cited a 263% increase in submissions and said it enriched 42,000 CVEs in 2025.