Action1 Says NVD Backlog May Leave Defenders With Incomplete Vulnerability Data
Summary
Action1 argues NIST’s NVD shift—about 30,000 pre-March 1, 2026 vulnerabilities marked “Not Scheduled”—could leave defenders with incomplete context, and recommends correlating multiple intelligence sources with asset data.
Key points
- The article says NIST reclassified roughly 30,000 vulnerabilities published before March 1, 2026, as “Not Scheduled” amid changes to NVD operations.
- Action1’s 2026 Software Vulnerability Ratings Report found disclosures in the analyzed enterprise software categories rose 92% in 2025 versus 2024; critical and high-severity vulnerabilities each rose 103%, and remote-code-execution vulnerabilities rose 128%.
- The author warns that delayed or missing enrichment—such as affected-platform and severity context—could make it harder for defenders to assess applicability and urgency.
- The article recommends correlating NVD data with vendor advisories, vulnerability-intelligence providers, threat-intelligence platforms, and internal asset inventories rather than relying on one source.
- Action1 says its vulnerability-management product combines multiple intelligence sources with endpoint data to prioritize vulnerabilities and support remediation in the same workflow.
Article Details
- Event Type
- NIST changed NVD vulnerability-enrichment operations, reclassifying roughly 30,000 vulnerabilities published before March 1, 2026, as "Not Scheduled."
- Impact
- The article warns that incomplete or delayed NVD enrichment may make it harder for defenders to determine whether vulnerabilities affect their environments and how urgently to address them. It says this could increase false positives, cause risks to be overlooked, and push organizations to correlate multiple intelligence sources; these are described as potential consequences, not confirmed incidents.