Full Report
NVD enrichment now covers only 15–20% of CVEs. Learn how Recorded Future Vulnerability Intelligence prioritizes risk using real attacker behavior signals.
Analysis Summary
# Vulnerability: Operational Gap Due to NIST NVD Enrichment Policy Change
## CVE Details
- **CVE ID**: Not applicable (This report covers a systemic change affecting ~80% of all future CVEs).
- **CVSS Score**: N/A (The core issue is the *absence* of CVSS scores for non-prioritized CVEs).
- **CWE**: Various (NIST has ceased weakness classification for most new entries).
## Affected Systems
- **Products**: Vulnerability Management (VM) workflows, Risk Assessment tools, and Security Orchestration platforms.
- **Versions**: Systems relying on NVD data feeds post-April 15, 2026.
- **Configurations**: Organizations that prioritize patching based solely on NVD-provided CVSS scores or CISA KEV listings.
## Vulnerability Description
As of April 2026, the NIST National Vulnerability Database (NVD) has transitioned to a restricted enrichment model. It now only provides metadata (CVSS scores, CWEs, and affected product mappings) for 15–20% of CVEs—specifically those in the CISA KEV catalog or critical federal software. The remaining ~80% of vulnerabilities are marked as "Lowest Priority" and lack the technical data required for traditional automated scanners to function effectively. This creates a massive operational "blind spot" for security teams.
## Exploitation
- **Status**: Varies by CVE. Exploitation often occurs in technical communities and underground forums *before* NVD enrichment.
- **Complexity**: Variable.
- **Attack Vector**: Primarily Network, as threat actors target internet-facing vulnerabilities before they are formally scored.
## Impact
- **Confidentiality**: High (Risk of data breach due to unprioritized vulnerabilities).
- **Integrity**: High (Risk of unauthorized system changes).
- **Availability**: High (Risk of ransomware/DoS targeting "unscored" flaws).
## Remediation
### Patches
- Organizations must transition to **CNA-supplied scores** (available for ~90% of CVEs) rather than NVD-only scores.
- Implement vendor-specific patches immediately upon release, even if the CVE lacks a formal NVD severity rating.
### Workarounds
- Shift from a "Severity-Based" (CVSS) to a "Risk-Based" (Threat Intelligence) prioritization model.
- Monitor alternative enrichment sources and GitHub repositories for PoC releases.
## Detection
- **Indicators of Compromise**: Monitor for scanning activity targeting newly assigned CVEs that have not yet been enriched by NIST.
- **Detection Methods**: Use advanced vulnerability intelligence platforms that weigh:
- Active exploitation in the wild.
- Ransomware and malware associations.
- Social media and offensive security forum sentiment.
- Verified vs. Unverified PoC availability.
## References
- NIST NVD Operations Update: hxxps[://]www[.]nist[.]gov/news-events/news/2026/04/nist-updates-nvd-operations-address-record-cve-growth
- CSA Research Note: hxxps[://]labs[.]cloudsecurityalliance[.]org/research/csa-research-note-nist-nvd-enrichment-policy-change-20260419/
- Recorded Future Prioritizing Strategy: hxxps[://]www[.]recordedfuture[.]com/blog/addressing-the-vulnerability-prioritization-challenge
- 2025 CVE Data Review: hxxps[://]jerrygamblin[.]com/2026/01/01/2025-cve-data-review/