NIST Just Admitted It Cannot Keep Up With Vulnerability Submissions

TL;DR

NIST has announced a risk-based triage model for the National Vulnerability Database. CVE submissions surged 263% between 2020 and 2025. Submissions during the first three months of 2026 are nearly one-third higher than the same period last year. FIRST forecasts 50,000 additional CVEs in 2026 alone. Despite enriching 42,000 CVEs in 2025 (45% more than any prior year), NIST said the effort is unsustainable. Going forward, only CVEs in CISA's KEV catalog, submitted by authorized CNAs, or meeting specific criteria will receive the analyst enrichment that defines a useful NVD entry. All backlogged CVEs with publish dates earlier than March 1, 2026 will be moved to "Not Scheduled" status.

The takeaway

Security researchers warn this will create blind spots for enterprises that rely on NVD data for vulnerability prioritization.

263%

CVE surge 2020-2025

42K

Enriched in 2025 (record)

50K+

FIRST forecast for 2026

WHAT NIST ANNOUNCED

The National Institute of Standards and Technology announced on April 15 that the National Vulnerability Database will shift to a risk-based prioritization model for CVE enrichment. Enrichment is the process of adding severity scores, CVSS vectors, affected product configurations, and technical descriptions that make a CVE entry actionable for defenders. Without enrichment, a CVE is just an identifier and a brief description. With enrichment, it becomes a searchable, prioritizable, and defendable record.

Going forward, NIST will only enrich CVEs that meet one of several narrow criteria. CVEs in CISA's Known Exploited Vulnerabilities catalog will continue to be enriched, as they have been. CVEs submitted by authorized federal CVE Numbering Authorities will also be prioritized. A small number of other categories qualify. Everything else will be listed in the NVD with basic information but will not receive the analyst enrichment that makes NVD data useful for enterprise vulnerability management.

Speaking at VulnCon 2026 in Scottsdale on the same day, NIST computer scientist Harold Booth was direct about why: "We are working faster than ever. We enriched nearly 42,000 CVEs in 2025, 45% more than any prior year. But this increased productivity is not enough to keep up with growing submissions. We've been trying to develop new tools to help with this, but with our current methods, I will admit this is just something we can't keep up with."

THE NUMBERS THAT BROKE THE SYSTEM

NIST's own statement puts the scale of the problem in stark terms. CVE submissions have increased 263% between 2020 and 2025. Submissions during the first three months of 2026 are nearly one-third higher than the same period last year. The Forum of Incident Response and Security Teams (FIRST) has forecast a record-breaking 50,000 additional CVEs to be reported in 2026 alone.

These numbers are not anomalies. They are the leading edge of AI-driven vulnerability discovery reaching the institutional vulnerability management infrastructure. On Wednesday we covered Dustin Childs of Trend Micro's Zero Day Initiative noting that AI-driven submissions have tripled ZDI's incoming rate. On Monday night we published our analysis of Anthropic's Claude Mythos and Project Glasswing, which demonstrated that AI can autonomously discover thousands of zero-day vulnerabilities across every major operating system and browser. Over 99% of Mythos' findings were still unpatched at announcement.

The arc across this week is unmistakable. Monday night: we argued AI would overwhelm the patch pipeline. Wednesday morning: Microsoft shipped its second-largest Patch Tuesday ever, 167 vulnerabilities, and ZDI confirmed tripled AI submissions. Today: NIST officially announced it cannot sustain full enrichment of the CVE ecosystem. The institutional infrastructure that security teams have relied on for two decades is restructuring in real time.

THE OPERATIONAL IMPACT

For any organization whose vulnerability management program depends on NVD data, this is a fundamental change. Most enterprise vulnerability scanners, SOAR platforms, and risk scoring tools pull CVSS scores, affected product lists, and configuration data from the NVD. When NIST stops enriching a CVE, that CVE still exists, but the downstream tooling has less information to work with. Security teams lose the ability to automatically prioritize vulnerabilities based on NVD data alone.

Caitlin Condon, vice president of security research at VulnCheck, put the tradeoff clearly: "NIST is clearly and publicly setting expectations for the community amid a huge and escalating volume of CVE submissions." The transparency is appreciated. The consequence is that enterprises now need alternative data sources. Condon and other researchers emphasize that organizations relying on a single source for vulnerability data will have significant blind spots going forward. Diverse data sources, including vendor advisories, exploit databases, and commercial vulnerability intelligence services, are now mandatory rather than optional.

The backlog sweep is the sharper edge of the announcement. Every unenriched CVE with a publish date earlier than March 1, 2026 has been moved to "Not Scheduled" status. NIST will consider enriching them "as resources allow," which is institutional language for "probably never." These vulnerabilities still exist in production software. They still pose real risks. They just will not appear in NVD searches with the enrichment data that most security tooling expects.

WHAT THIS MEANS FOR THE ATARUS AUDIENCE

1
Do not rely exclusively on NVD for vulnerability prioritization. If your vulnerability management program queries NVD for CVSS scores and affected product data, you now need additional data sources. Vendor advisories (Microsoft, Fortinet, Cisco, Oracle, SAP), CISA KEV, and commercial vulnerability intelligence platforms (VulnCheck, First.org EPSS, Tenable, Rapid7) all provide enrichment data that NIST may no longer produce for every CVE.
2
CISA KEV becomes even more important. NIST will continue to enrich every CVE in the KEV catalog. If you are not already using CISA KEV as a primary signal for patch prioritization, now is the time to integrate it into your vulnerability management workflow. KEV is the authoritative source for vulnerabilities under active exploitation.
3
Audit your vulnerability tooling's data sources. If your scanner, SIEM, or risk platform only enriches from NVD, you may see degraded data quality over the next 12 months as more CVEs fall into the unenriched category. Talk to your vendors about their enrichment strategy. Ask which additional sources they pull from. If the answer is "just NVD," escalate.
4
For organizations that develop software or maintain open-source dependencies, subscribe directly to vendor security advisories and GitHub Security Advisories. Do not wait for NVD to tell you a library you depend on has a vulnerability. The lag time between CVE publication and NVD enrichment was already a problem. With the new prioritization model, many CVEs will never be enriched at all.
5
Recognize that the institutional infrastructure of cybersecurity is restructuring under AI-driven pressure. NIST is the first major institution to publicly acknowledge it cannot keep pace. It will not be the last. CVE Numbering Authorities, vulnerability disclosure programs, and vendor patching cycles are all facing the same volume pressure. Plan for a vulnerability landscape where institutional support is less comprehensive and internal capability is more important.

ATARUS ASSESSMENT

The arc of this week has been unusual even by the standards of the current threat landscape. On Monday night we published our analysis of Anthropic's Claude Mythos and argued that AI would overwhelm the defensive patch pipeline. On Wednesday morning Microsoft shipped its second-largest Patch Tuesday ever and ZDI confirmed AI had tripled their submission rate. Today NIST announced it can no longer enrich every CVE because of a 263% surge in submissions since 2020. The institutional infrastructure of vulnerability management has publicly broken under the load, and the broader AI acceleration has barely started. Claude Mythos represents a capability that has not proliferated yet. When it does, or when comparable capabilities reach threat actors, the 50,000 CVE forecast for 2026 will look conservative. For organizations that have treated the NVD as the authoritative source of vulnerability truth, this week is the signal that the old model is over. The defensive ecosystem that worked in a world where human researchers drove vulnerability discovery cannot work in a world where AI does it at industrial scale. NIST just admitted that publicly. The organizations that adapt fastest to a multi-source, intelligence-driven vulnerability management model will be the ones that survive the volume that is coming.