cyber.hendryadrian.com
Security News · darkreading.com

NIST to Prioritize CVE Enrichment as NVD Backlog Grows

· Original article ↗

Summary

NIST will prioritize which CVEs receive detailed NVD enrichment as submissions outpace manual capacity. The article describes how the change may affect defenders and industry proposals to improve reporting and fill information gaps.

Key points

  • NIST says the NVD will prioritize CVEs for enrichment based on potential widespread impact; all CVEs will remain accessible, and users can request enrichment or scoring.
  • The article links the backlog to rising CVE submissions, limited staffing, and budget cuts; NIST lost 12% of its federal funding in 2024.
  • CNAs created about 40,000 CVE records in 2025, and CISA's Lindsey Cerovnik said the number could reach 60,000 by the end of 2026.
  • CISA is considering requiring more information when CVEs are filed, while experts say CNAs and vendors should provide more complete and timely records.
  • Experts advise organizations to accelerate patching, identify affected products with vendors, and consider automated or private-sector enrichment tools.

Article Details

Event Type
NIST is changing National Vulnerability Database operations to prioritize which CVEs receive detailed enrichment instead of enriching every entry.
Impact
Reduced NVD enrichment may leave less detail about affected products and attack vectors, shifting more vulnerability research and validation work to downstream organizations. The article says all CVEs will remain accessible and CVSS scores will still be available through CNAs, CISA, or NVD; users may also request enrichment or scoring for a specific CVE.

People

Adam ShostackIndustry expert who recommended accelerating patching and reducing the potential impact of vulnerabilities.Alec SummersMITRE CVE/CWE project leader who described the minimal information currently required in a CVE record.Bob LordFormer CISA technical adviser who argued that CNAs should provide more complete CVE details when records are issued.Dick BrooksCVE Consumer Working Group participant who discussed delayed vendor updates to CVE records and procurement language for timely vulnerability reporting.Harold BoothNVD program manager who explained NIST's decision to prioritize CVE enrichment and described the criteria and services that will remain available.Jessica SicaWeave CISO who commented on the operational consequences of reduced NVD enrichment and the need for other sources of vulnerability information.Lindsey CerovnikCISA chief of vulnerability response who discussed CVE submission volumes and efforts to require more information when CVEs are filed.Shane FryRunSafe Security CTO who discussed the growth in vulnerability submissions and recommended building defenses into software.

Tools

MythosCyber teams and vendors are urged to adapt by improving CNA reporting, speeding patch deployment, and using automated or private-sector tools (such as Anthropic’s Mythos) to fill gaps as NVD coverage shrinks.

Industries

Cybersecurity“Organizations will still have access to all CVEs in the NVD.” CVSS scores will still be available from either the CVE Numbering Authority (CNA), Cybersecurity and Infrastructure Security Agency (CISA), or the NVD.Energyinto procurement language, according to Brooks, who is working on a similar initiative with the US energy sector.Software“Staffing cuts and proliferation of vulnerabilities made this inevitable,” according to Jessica Sica, chief information security officer (CISO) at Weave, a  telecom software vendor.

Related Articles