NIST Overhauls How It Handles CVEs in the National Vulnerability Database

The National Institute of Standards and Technology (NIST) has announced a fundamental shift in how it manages the Common Vulnerabilities and Exposures (CVE) framework — and the change has significant implications for every security team relying on the National Vulnerability Database (NVD) to guide patch management. Effective April 15, 2026, NIST will no longer enrich every CVE submitted to the NVD. Instead, the agency is adopting a risk-based model that concentrates resources on vulnerabilities with the greatest real-world impact.

The Problem: A CVE Backlog That Has Become Unmanageable

The numbers tell a stark story. CVE submissions to NIST increased 263% between 2020 and 2025, and the volume of submissions in the first three months of 2026 alone is already nearly one-third higher than the same period last year. In 2025, NIST enriched nearly 42,000 CVEs — 45% more than any previous year — and still could not keep pace.

The root causes of the surge are well understood: improved automated detection tooling, AI-assisted vulnerability discovery, the proliferation of bug bounty programs, and the accelerating pace of software development (itself increasingly driven by AI). The result is a database that has grown faster than any centralized institution can realistically maintain at the level of detail defenders need.

NIST itself acknowledged the situation is more serious than previously indicated, stating publicly that it is struggling to "keep up with growing submissions." For enterprise defenders who depend on NVD metadata — severity scores, affected product lists, exploitation risk factors — this is a significant operational concern.

What Changes Under the New Risk-Based Model

All submitted CVEs will continue to be added to the NVD. What changes is the depth of analysis each entry receives. Going forward, NIST will provide full enrichment only for CVEs that fall into one of three priority categories:

• CISA KEV catalog entries: Vulnerabilities confirmed as actively exploited in the wild and listed in the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog.
• Federal government software: Flaws affecting software actively used across U.S. federal agencies.
• Critical software under EO 14028: Vulnerabilities in software designated as critical by Executive Order 14028 on Improving the Nation's Cybersecurity — including software running with elevated privileges or controlling access to operational technology.

CVEs that do not meet any of these criteria will still appear in the NVD but will be marked "Not Scheduled" — meaning no severity scoring, no affected product details, and no exploitation context will be provided by NIST. The same deferred status applies to the existing backlog, with one notable exception: any backlogged CVE already present in the CISA KEV catalog will not be deferred.

Why Experts Say This Was Inevitable

Security researchers and practitioners have long argued that the centralized, database-enrichment model was structurally unsustainable. The new approach formalizes what many in the industry had already internalized in practice.

"What NIST is acknowledging is something the research community has understood for years: You cannot centralize vulnerability triage at this volume and expect it to hold. The signal that actually drives remediation priority has always come from real-world exploitability, not database metadata, and that requires human researchers with adversarial instincts working continuously against live environments."

— Trey Ford, Chief Strategy and Trust Officer, Bugcrowd

Ford anticipates that the next generation of vulnerability programs will be built around active, distributed signals rather than periodic enrichment cycles — a model where private-sector researchers and threat intelligence platforms carry more of the triage burden.

The End of CVSS-Driven Compliance as a Default Strategy

For many organizations, the NVD has functioned as a passive compliance anchor: if NIST scored it, teams would patch it — eventually — working roughly in CVSS score order. That model is now explicitly obsolete.

"NIST's decision to prioritize high-impact vulnerabilities signals the end of an era where security teams could rely on a single government database to categorize every software flaw. Modern defenders must move beyond the noise of total CVE volume and instead focus their limited resources on the CISA KEV list and exploitability metrics."

— David Lindner, CISO, Contrast Security

Lindner frames the transition as a forced maturation of enterprise vulnerability management — from reactive compliance based on raw CVSS scores to proactive risk management driven by threat intelligence. While legacy auditing workflows built around NVD completeness may face short-term disruption, the long-term effect could be healthier prioritization across the industry.

"Relying on a curated subset of actionable data is far more effective for national resilience than maintaining a comprehensive but unmanageable archive of every minor bug," Lindner noted.

What Security Teams Should Do Right Now

The practical implications of NIST's shift are immediate. Organizations that have historically treated NVD enrichment as a complete signal for patch prioritization need to update their processes. Key actions to take include:

• Subscribe to and operationalize the CISA KEV catalog. This list is now the highest-fidelity, institutionally-backed signal for active exploitation risk — and NIST will continue to fully enrich all KEV entries.
• Augment NVD data with third-party threat intelligence. Commercial vulnerability intelligence platforms that track real-world exploitation evidence — proof-of-concept availability, dark web chatter, active campaigns — become significantly more valuable in a world where NVD metadata is incomplete.
• Audit any compliance workflows that assume NVD completeness. Automated patch management pipelines, audit checklists, and reporting frameworks that rely on NVD severity scores for non-KEV, non-federal-software CVEs will begin encountering "Not Scheduled" entries and need to handle that state gracefully.
• Shift remediation priority conversations toward exploitability, not theoretical severity. A critical CVSS score on a vulnerability with no public exploit code, limited deployment surface, and no KEV listing is categorically different from a medium-severity flaw being actively weaponized in the wild.

Conclusion: A Necessary Reset for Vulnerability Management

NIST's decision to adopt a risk-based CVE prioritization model is a candid acknowledgment of a structural reality the security community has grappled with for years. The exponential growth in reported vulnerabilities has made comprehensive centralized enrichment impossible to sustain at the pace defenders need. By focusing NVD resources on vulnerabilities with confirmed or high-probability real-world impact — through the CISA KEV catalog, federal software, and EO 14028-designated critical systems — NIST is aligning its output more closely with how mature security programs already operate.

The organizations that will fare best in this new landscape are those that treat vulnerability management as an ongoing, intelligence-driven discipline rather than a periodic compliance exercise. The backlog crisis that prompted this change is, in a sense, an opportunity: a forcing function to move past the false comfort of database completeness and toward the sharper, harder work of prioritizing actual exposure over theoretical severity.