NIST narrows CVE enrichment as submissions outpace capacity
Summary
NIST will prioritize NVD enrichment for CISA-listed exploited flaws and vulnerabilities in federal or critical products, move older backlog records to “Not Scheduled,” and rely on submitter severity scores as submissions outpace staff capacity.
Key points
- NIST says CVE submissions are outpacing its capacity to enrich every NVD record.
- NIST will prioritize enrichment for CVEs in CISA’s exploited-vulnerabilities catalog and those affecting federal or critical products.
- NIST says CVEs listed in CISA’s catalog will be enriched within one day of notice.
- Backlogged CVEs with NVD publish dates before March 1, 2026, will move to “Not Scheduled”; qualifying records may still be prioritized.
- NIST will rely on submitter-provided severity scores instead of assigning its own score to every CVE.
- NIST said its 21-person staff enriched nearly 42,000 CVEs in 2025, but the backlog remains as submissions grow.
Article Details
- Event Type
- NIST policy change limiting enrichment of CVE records in the National Vulnerability Database (NVD) amid a surge in submissions.
- Impact
- NIST will prioritize enrichment for CVEs in CISA’s catalog of exploited vulnerabilities, vulnerabilities affecting federal-government products, and vulnerabilities in software deemed critical. Other CVEs will remain listed without new enrichment, and backlogged CVEs with NVD publish dates before March 1, 2026, will be moved to “Not Scheduled.” NIST will rely on submitter-provided severity scores instead of providing its own score for every CVE. The policy may leave some potentially high-impact vulnerabilities without enrichment; researchers can request enrichment from NIST.