NIST Abandons Universal CVE Enrichment, Shifting the National Vulnerability Database to Risk-Based Triage as Submissions Surge 263 Percent
NIST will now enrich only CVEs meeting federal priority criteria, leaving thousands of vulnerabilities without severity scores as AI-driven discovery overwhelms the 21-person NVD team.
Overview
The National Institute of Standards and Technology announced on April 15 that it will no longer attempt to enrich every CVE submitted to the National Vulnerability Database, shifting instead to a risk-based model that prioritizes only the most critical vulnerabilities. The policy change, effective immediately, marks the most significant operational overhaul in the NVD’s two-decade history and arrives as CVE submissions have surged 263 percent between 2020 and 2025, according to NIST’s announcement.
CVEs that do not meet the new criteria will still appear in the database but will be marked “Not Scheduled” for enrichment, meaning they will lack the severity scores and product classification data that security teams rely on to prioritize patching.
What Changed
Under the new framework, NIST will fully enrich only CVEs meeting one of three conditions: those listed in CISA’s Known Exploited Vulnerabilities catalog, those affecting software used within the federal government, and those impacting critical software as defined by Executive Order 14028, which covers categories such as identity management systems, operating systems, web browsers, endpoint security tools, and network infrastructure, as reported by CyberScoop.
For vulnerabilities appearing in the KEV catalog, NIST is targeting enrichment within one business day of receipt, according to the official announcement. NIST will also stop routinely generating independent CVSS severity scores where CVE Numbering Authorities have already provided one, and will no longer re-analyze all modified CVEs unless the modification materially impacts enrichment data.
All backlogged CVEs with a publish date before March 1, 2026, have been moved into the “Not Scheduled” category, though organizations can request enrichment of specific entries by emailing NIST.
What We Know
The numbers behind the decision paint a picture of an agency overwhelmed by volume. NIST enriched nearly 42,000 CVEs in 2025, a figure NIST described as 45 percent more than any prior year. Despite that record output, submissions in the first quarter of 2026 ran nearly one-third higher than the same period in 2025. The NVD team responsible for this work consists of just 21 people, as CyberScoop reported.
AI-powered vulnerability discovery tools have accelerated the submission rate. SlashID CEO Vincenzo Iozzo told SiliconAngle that “AI-reported valid vulnerabilities more than doubled last year,” contributing to a flood that the NVD’s manual enrichment process was never designed to absorb.
Of the 40,000-plus newly published vulnerabilities cataloged last year, only about one percent (422 defects) were actually exploited in the wild, according to data cited by CyberScoop, suggesting that the vast majority of CVEs represent theoretical rather than active risk.
What We Don’t Know
NIST has not published a detailed estimate of how many CVEs will fall outside the new prioritization criteria, leaving security teams uncertain about the scope of the gap. The agency acknowledged that its criteria “may not catch every potentially high-impact CVE,” but has not outlined how edge cases will be escalated beyond the email-based request process.
It also remains unclear how long the risk-based model is intended to last. NIST has indicated it hopes the approach will buy time to develop automated enrichment tools, but no timeline or budget has been disclosed for that effort.
Analysis
The policy shift effectively ends a longstanding assumption in enterprise security: that every disclosed vulnerability would eventually receive a standardized severity assessment from the U.S. government’s authoritative source. Dustin Childs, head of Trend Micro’s Zero Day Initiative, told CyberScoop that NIST “had to do something” and was “set up for failure” under its previous system.
RunSafe Security CTO Shane Fry framed the change more bluntly in comments to SiliconAngle, stating that “the era of waiting for a CVE score before acting has come to an end.”
For organizations that depend on NVD enrichment data to feed vulnerability scanners and patch management workflows, the practical impact could be significant. CVEs lacking NIST-provided severity scores may still carry CNA-assigned ratings, but those assessments vary in quality and consistency. Security teams that have treated NVD data as a universal baseline will need to supplement it with threat intelligence feeds, vendor advisories, or commercial vulnerability databases to maintain coverage.
This is not the NVD’s first crisis. NIST faced a funding lapse in early 2024 that temporarily halted key metadata provision and created a backlog that persisted for months. The current restructuring suggests that the 2024 disruption was not an anomaly but a symptom of structural underfunding relative to the exponential growth in disclosed vulnerabilities.