Summary: NIST will stop committing to enrich every CVE and will prioritize only KEV, federal-use, and critical-software CVEs; entries backlogged before March 1, 2026 become Not Scheduled. CVE submissions rose 263% from 2020 to 2025, reaching 49,458 in 2025, as exploit creation also accelerated. The article frames this as a formal downgrade of a global patch-workflow reference whose severity and product-mapping data will now be absent more often.
Mid-April brought the largest operational reversal in the National Vulnerability Database’s history. NIST will no longer commit to enriching every CVE — enrichment meaning the added severity scores, affected-product lists, and other analysis data — and will handle only three high-priority classes instead, while CVEs backlogged before March 1, 2026 are all relabeled “Not Scheduled.” The status-field changes on NVD were first noticed by researchers around April 13–14; NIST then published the formal announcement, “NIST Updates NVD Operations to Address Record CVE Growth,” on April 15.
Nothing routine about this one. Scanners, SBOM tooling, and SOC playbooks — the plumbing of patch workflows worldwide — have treated NVD as the go-to reference for severity and affected scope for years, so abandoning enrichment amounts to a formal downgrade in the service level of a piece of public infrastructure.
Three Classes Now Form the Immediate Queue
The new criteria narrow immediate enrichment to three classes: CVEs listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog, targeted for completion within one business day of receipt; CVEs covering software the federal government uses; and CVEs for “critical software” as defined by Executive Order 14028. Everything else falls under “Lowest Priority - not scheduled for immediate enrichment,” and anyone who needs a particular CVE worked on can email NIST to request it. One further structural change: when the issuing CVE Numbering Authority (CNA) has already supplied a severity score, NIST will not routinely score the same CVE a second time.
Status labels and the surrounding tooling shifted too: CVEs tagged “Deferred” in 2025 will move in batches to “Modified After Enrichment” across two weeks; entries that are already enriched get re-analyzed only when a modification materially affects enrichment data; and the NVD Dashboard now reflects pending volume in real time. NIST is not claiming the backlog will vanish — it rewrote what “pending” means.
How 27,000 Unanalyzed CVEs Piled Up
The enrichment backlog has been deteriorating since early 2024: around 13,000 entries in mid-2024, 18,358 by September 2024 (72.4% of that period’s new CVEs went unanalyzed), 25,000 by March 2025, and past 27,000 by the end of 2025. The numbers NIST lists in its own announcement are just as blunt: CVE submissions climbed 263% between 2020 and 2025; the first three months of 2026 came in nearly one-third above the same period last year; and the ~42,000 CVEs enriched in 2025 were 45% more than any prior year. Record throughput, and the inflow still wins.
Zoom out and the structural view is starker. By Project Discovery’s count, the four years of 2018–2021 turned out roughly 77,000 CVEs while 2022–2025 swelled to about 146,000 — nearly double. High-severity findings more than doubled too, from about 7,400 to about 15,900. Past a certain volume, the quantity changes the nature of the problem.
AI Reshaped the Vulnerability Curve
Project Discovery offers the clearest causal reading. Annual CVE output sat at 18k–21k from 2018 through 2021, then rose two years running (+32% from 2023 to 2024, +23% from 2024 to 2025) to reach 49,458 in 2025 — a timeline that overlaps the reasoning-model and agentic-coding wave. Attackers accelerated in step: AI systems reportedly produce working exploits in roughly 10–15 minutes at $1–3 per attempt; in reproduction experiments on 2024–2025 CVEs, the CVE-Genie research framework rediscovered 51% of them with verified exploits at an average cost of $2.77; and separate experiments had GPT-4 exploiting 87% of tested CVEs from the description alone. In-the-wild zero-days climbed from 20–30 per year before 2021 to 60–100 since. Mandiant’s measured time-to-exploit has shrunk from 63 days in 2018 to single digits, even negative, in recent periods. When output arrives at machine speed and review still runs at human speed, the endpoint is exactly this kind of policy surrender.
What Changes for Scanners and Patch Pipelines
The fallout lands in three places. Severity and product-mapping data will go missing more often: teams that order patches by NVD scores have to move to a mix of original CNA scores, EPSS, KEV, and vendor advisories, and with NIST no longer duplicating scores, the quality of CNA self-reporting now decides the quality of every downstream ranking. “Not enriched by NVD” is not the same as “not dangerous”: the tens of thousands of CVEs now marked Not Scheduled lost official analysis and nothing else — their real risk is unchanged, so tracking logic has to be built in-house. And assumptions about patch windows need rewriting, because when exploitation velocity is measured in hours, both 90-day disclosure norms and quarterly patch cycles have to compress along with them.
The 2026 opening outlook already carried the “security engineering gets rebuilt under AI-driven output pressure” thread — this is its concrete case (see the 2026 AI opening outlook). The NVD downgrade is not where the story ends: responsibility for vulnerability management moves off a public facility and onto each engineering team on its own.