Loading story…
NIST is reevaluating its role in analyzing and “enriching” vulnerabilities in the National Vulnerability Database (NVD) as demand for vulnerability analysis continues to outpace the agency’s capacity. NIST leadership told the Information Security and Privacy Advisory Board that the enrichment process is labor-intensive and “not scalable” given the volume of incoming CVEs, prompting a strategic review and a shift toward prioritizing/triaging which vulnerabilities receive deeper analysis.
The broader ecosystem is also seeing parallel efforts to improve vulnerability correlation and disclosure workflows outside of any single identifier system. Vulnerability-Lookup is positioned as a sharing and correlation platform that aggregates vulnerability information from multiple sources, supports sightings (e.g., seen, exploited, patched), and is designed to operate independently of specific vulnerability IDs while remaining compatible with the Global CVE Allocation System (GCVE)—highlighting how tooling and processes are evolving as stakeholders question scalability and governance of centralized vulnerability analysis.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
NIST said it is coordinating with CISA over possible duplication with the Vulnrichment project and engaging with Europe's GCVE initiative to reduce fragmentation in vulnerability data efforts. A Commerce Department inspector general audit of the NVD was also noted as ongoing.
As part of its reassessment, NIST said it plans to publish a strategy and implementation plan, hire a program manager if authorized, and consult stakeholders on which NVD data is most useful. It also said it wants to eventually shift more enrichment responsibility to CVE Numbering Authorities after issuing guidance.
NIST said it will formalize which vulnerabilities receive enrichment, prioritizing items such as those in CISA's Known Exploited Vulnerabilities catalog and software relevant to federal agencies or critical systems. The move is intended to focus limited resources on the most consequential CVEs.
Acting Computer Security Division chief Jon Boyens said NIST has been unable to keep up with the volume of incoming CVEs, describing the current enrichment process as labor-intensive and not scalable. NIST also signaled it does not intend to enrich every CVE submission.
NIST launched a strategic review of the NVD as demand for vulnerability analysis increased and scrutiny grew over the U.S. government's role in the CVE/NVD ecosystem. The review is examining how NIST should prioritize and deliver vulnerability enrichment going forward.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Department of Commerce Office of Inspector General audit found that **NIST mismanaged the National Vulnerability Database (NVD)**, allowing a backlog of unprocessed vulnerabilities to surge from about 13,000 in 2024 to more than 27,000 by the end of 2025 after a key enrichment support contract lapsed in February 2024. Auditors said NIST had years of notice before the contract expired but failed to prepare adequately, leaving the program understaffed and causing vulnerability processing to nearly halt. The report also said NIST missed its own recovery goals, lacked a strategic plan, and communicated poorly with stakeholders, undermining confidence in one of the federal government’s most widely used vulnerability resources. The audit said delays were worsened by inefficient enrichment workflows, heavy time spent on **CVSS** scoring, and duplicated effort with **CISA**’s Vulnrichment program in roughly 21,000 cases, wasting an estimated $200,000. Auditors found NIST was slow to incorporate CISA data, did not consistently prioritize the most critical flaws, and could save about $800,000 over two years by relying more on vendor-provided severity scores. NIST agreed with the recommendations and said it would adopt operational improvements, including a more risk-based approach that prioritizes high-impact CVEs and greater use of scores supplied by CVE Numbering Authorities, though it disputed parts of the auditors’ characterization and said statutory requirements were not fully considered.
Jun 29, 2026
The cybersecurity industry is facing significant challenges in vulnerability management, particularly in the areas of exposure management and the handling of Common Vulnerabilities and Exposures (CVE) data. Recent analysis highlights the evolving landscape of exposure management, with a shift toward Continuous Threat Exposure Management (CTEM) and the use of real-world metrics to assess organizational risk, especially among small and medium-sized businesses (SMBs) that often lack the resources of larger enterprises. The concept of the cybersecurity poverty line underscores the disparity in security capabilities, even as threats remain consistent across organizations of all sizes. Simultaneously, the process of tracking and enriching CVE data has come under scrutiny due to operational and funding challenges. The National Vulnerability Database (NVD), managed by NIST, experienced a significant backlog in CVE processing after a funding shortfall, revealing the risks of relying on a single, government-funded point of failure for global vulnerability data. Experts are now calling for a decentralized, global approach to CVE data management to ensure timely enrichment and analysis, as only a fraction of assigned CVE identifiers are currently fully processed. These issues highlight the urgent need for innovation and investment in both exposure management practices and the infrastructure supporting vulnerability intelligence.
Jun 30, 2026
NIST has issued a Request for Information seeking public input on modernizing the National Vulnerability Database to better support an AI-shaped cybersecurity environment. The agency said traditional vulnerability management built around periodic scanning, static prioritization and manual remediation is no longer sufficient as disclosed vulnerabilities grow in volume and complexity, technology cycles accelerate, and machine-consumable security data becomes more important. The Federal Register notice includes 30 questions and asks stakeholders to weigh in on improving the NVD’s scalability, interoperability, transparency, automation and near-real-time usefulness. The agency is specifically asking how artificial intelligence could improve vulnerability documentation, risk assessment, remediation and the broader vulnerability management lifecycle, while also addressing risks from AI-assisted vulnerability discovery and exploitation. NIST is also evaluating whether changes to organizational structures, standards and handling procedures are needed to improve data quality and operations, and said the effort is not a response to recent executive orders or the federal **Gold Eagle** initiative. Public comments will be accepted through October 13.
Aug 17, 2026