NIST Prioritizes High-Impact CVEs in NVD Amid Surge

The U.S. National Institute of Standards and Technology announced changes on April 15, 2026, to its management of common vulnerabilities and exposures in the National Vulnerability Database, prioritizing enrichment for only select high-impact entries amid a sharp rise in submissions.

The agency, which maintains the database to help cybersecurity professionals identify and mitigate software flaws, will now add detailed analyses, such as severity scores and affected product lists, solely to vulnerabilities meeting specific criteria. These include those listed in the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog, flaws in software used by federal agencies, and issues in critical software as outlined in Executive Order 14028. Such critical software encompasses systems running with elevated privileges, accessing networking or computing resources, controlling data or operational technology, or operating beyond normal trust boundaries.

Vulnerabilities not meeting these standards will remain listed in the database but marked as "Not Scheduled" for enrichment, reducing the agency's workload. NIST stated that this risk-based approach targets...