NIST Admits Defeat on the CVE Backlog — Will Only Fully Enrich the Most Critical Vulnerabilities Going Forward

NIST has announced it is fundamentally changing how it operates the National Vulnerability Database (NVD). The agency will no longer fully enrich every CVE submitted. Instead, it will apply detailed analysis only to vulnerabilities that meet a narrow set of risk-based criteria. Everything else gets basic ingestion and sits in a “Not Scheduled” queue indefinitely.

This is not a temporary backlog fix. It’s a structural retreat.

Why NIST Is Doing This

CVE submissions grew 263% between 2020 and 2025. The first quarter of 2026 came in 33% above Q1 2025. NIST’s analysis capacity did not scale at anywhere near that rate. The backlog became untenable.

Projections from SC Media suggest total CVE publications in 2026 could break 50,000 — more than the previous four years combined. No government agency can meaningfully analyze that volume with current staffing and processes.

The New Prioritization Rules

A CVE will receive full NVD enrichment only if it meets at least one of the following conditions:

• It appears on CISA’s Known Exploited Vulnerabilities (KEV) catalog
• It affects software used within the federal government
• It affects software classified as critical under Executive Order 14028

For all other CVEs, NIST will ingest the identifier and the description from the CVE Numbering Authority but stop short of providing severity scores, CVSS vectors, CPE matching data, or reference enrichment.

Additionally: all CVEs with an NVD publish date before March 1, 2026 are being moved to the “Not Scheduled” category immediately. That’s years of historic vulnerability data that will not be retroactively enriched.

What Changes for Security Teams

The NVD is the backbone of most vulnerability management platforms. SCA tools, SBOM analyzers, patch prioritization engines, and compliance dashboards all pull from it. When NIST stops providing CVSS vectors and CPE data for most CVEs, those tools get incomplete signals.

In practice, this means:

• Open source library CVEs that don’t hit federal software lists will arrive with no severity score
• Legacy and niche software vulnerabilities will go unenriched unless someone flags them for re-analysis
• Re-analysis requests can be submitted to NIST via email, but there’s no SLA on turnaround

The burden shifts downstream. Security vendors, maintainers, and enterprise teams will need to independently assess and enrich the CVEs that fall outside NIST’s new priority window.

The Systemic Risk

NIST is making a reasonable triage call under impossible conditions. But the downstream effects are real.

Smaller organizations that relied on NVD data as a free, authoritative severity source now have a coverage gap. CVE Numbering Authorities (CNAs) — which include major vendors and research organizations — will provide their own CVSS scores for the CVEs they issue, but quality and consistency vary significantly across thousands of CNAs.

The organizations best positioned to absorb this change are those already running commercial vulnerability intelligence platforms (Tenable, Rapid7, Qualys, Snyk) that augment NVD data with their own enrichment pipelines. Organizations relying on NVD alone will notice gaps within weeks.

For now, NIST is inviting feedback on the new model and has not ruled out adjustments. But the direction is set: the era of NIST enriching every CVE as a public good is over.