Loading story…
NIST has issued a Request for Information seeking public input on modernizing the National Vulnerability Database to better support an AI-shaped cybersecurity environment. The agency said traditional vulnerability management built around periodic scanning, static prioritization and manual remediation is no longer sufficient as disclosed vulnerabilities grow in volume and complexity, technology cycles accelerate, and machine-consumable security data becomes more important. The Federal Register notice includes 30 questions and asks stakeholders to weigh in on improving the NVD’s scalability, interoperability, transparency, automation and near-real-time usefulness.
The agency is specifically asking how artificial intelligence could improve vulnerability documentation, risk assessment, remediation and the broader vulnerability management lifecycle, while also addressing risks from AI-assisted vulnerability discovery and exploitation. NIST is also evaluating whether changes to organizational structures, standards and handling procedures are needed to improve data quality and operations, and said the effort is not a response to recent executive orders or the federal Gold Eagle initiative. Public comments will be accepted through October 13.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
NIST published a Request for Information in the Federal Register seeking public input on modernizing the National Vulnerability Database to better support AI, automation, machine-readable security data, and growing vulnerability volume and complexity. The agency said the effort is intended to improve the NVD’s scalability, interoperability, transparency, and utility across the vulnerability management lifecycle.
CISA launched the Vulnrichment program to provide CVE-data enrichment following degradation in NVD’s enrichment capabilities. The program performs much of the enrichment traditionally supplied by NVD, though NVD remains uniquely positioned to create authoritative CPE entries.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
11 references tracked. Mallory keeps watching after this page renders.
runzero.com
Open sourceitpro.com
Open sourcesocket.dev
Open sourcedarkreading.com
Open sourcenist.gov
Open sourcefederalregister.gov
Open sourcenist.gov
Open sourcenvd.nist.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA has ordered U.S. federal civilian agencies to move away from deadline-driven patching based primarily on CVSS scores and adopt a risk-based remediation model under **Binding Operational Directive `26-04`**. The directive ties remediation timelines to factors including public exposure, Known Exploited Vulnerabilities status, exploit automation, and technical impact, and it also requires forensic checks for the highest-risk flaws because patching alone may not remove an existing compromise. The order consolidates earlier directives and gives agencies 180 days to fully align their vulnerability handling processes. The policy shift comes as NIST seeks public input on a broader overhaul of the **National Vulnerability Database** to support AI-era vulnerability reporting and machine-consumable security data. NIST said rising disclosure volume, inconsistent data quality, and growing reliance on automation are making static prioritization and manual remediation increasingly inadequate, and it is asking stakeholders how AI should be integrated into reporting, dissemination, transparency, auditability, and remediation workflows. Together, the efforts signal a federal push toward faster, context-aware vulnerability prioritization and response.
Aug 13, 2026
**NIST is reevaluating its role in analyzing and “enriching” vulnerabilities in the National Vulnerability Database (NVD)** as demand for vulnerability analysis continues to outpace the agency’s capacity. NIST leadership told the Information Security and Privacy Advisory Board that the enrichment process is *labor-intensive* and “not scalable” given the volume of incoming CVEs, prompting a strategic review and a shift toward **prioritizing/triaging** which vulnerabilities receive deeper analysis. The broader ecosystem is also seeing parallel efforts to improve vulnerability correlation and disclosure workflows outside of any single identifier system. *Vulnerability-Lookup* is positioned as a sharing and correlation platform that aggregates vulnerability information from multiple sources, supports sightings (e.g., *seen*, *exploited*, *patched*), and is designed to operate independently of specific vulnerability IDs while remaining compatible with the **Global CVE Allocation System (GCVE)**—highlighting how tooling and processes are evolving as stakeholders question scalability and governance of centralized vulnerability analysis.
Jul 12, 2026
A Department of Commerce Office of Inspector General audit found that **NIST mismanaged the National Vulnerability Database (NVD)**, allowing a backlog of unprocessed vulnerabilities to surge from about 13,000 in 2024 to more than 27,000 by the end of 2025 after a key enrichment support contract lapsed in February 2024. Auditors said NIST had years of notice before the contract expired but failed to prepare adequately, leaving the program understaffed and causing vulnerability processing to nearly halt. The report also said NIST missed its own recovery goals, lacked a strategic plan, and communicated poorly with stakeholders, undermining confidence in one of the federal government’s most widely used vulnerability resources. The audit said delays were worsened by inefficient enrichment workflows, heavy time spent on **CVSS** scoring, and duplicated effort with **CISA**’s Vulnrichment program in roughly 21,000 cases, wasting an estimated $200,000. Auditors found NIST was slow to incorporate CISA data, did not consistently prioritize the most critical flaws, and could save about $800,000 over two years by relying more on vendor-provided severity scores. NIST agreed with the recommendations and said it would adopt operational improvements, including a more risk-based approach that prioritizes high-impact CVEs and greater use of scores supplied by CVE Numbering Authorities, though it disputed parts of the auditors’ characterization and said statutory requirements were not fully considered.
Jun 29, 2026