NIST Adopts Risk-Based NVD Model as CVE Submissions Jump 263% Since 2020

According to a recent announcement from the National Institute of Standards and Technology (NIST), the agency is fundamentally restructuring how it manages the National Vulnerability Database (NVD).

Driven by a massive 263% increase in Common Vulnerabilities and Exposures (CVE) submissions between 2020 and 2025, NIST is shifting from a comprehensive analysis approach to a targeted, risk-based model.

Despite processing a record-breaking 42,000 vulnerabilities last year, a 45% increase over any previous year, the agency noted that current submission rates in early 2026 are already outpacing those figures.

To ensure long-term sustainability and maintain immediate focus on severe threats, NIST will now selectively “enrich” vulnerabilities that meet specific high-risk criteria rather than analyzing every single submission.

High-Priority Enrichment Criteria

Starting April 15, 2026, NIST will focus its immediate enrichment efforts on the vulnerabilities that pose the greatest systemic risks.

Enrichment involves adding crucial metadata, such as severity scores and affected product lists, which helps cybersecurity professionals prioritize their patching and mitigation efforts. The new prioritization model targets:

• Vulnerabilities listed in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) Catalog, which NIST aims to process within one business day.
• Software flaws affecting systems used within the federal government.
• Vulnerabilities impacting critical software as defined by Executive Order 14028.

Submissions falling outside these three categories will still enter the NVD but will receive a “Lowest Priority” designation.

While these lower-priority flaws might still severely impact specific systems, NIST indicates they generally lack the widespread systemic risk of the prioritized categories.

However, security teams can request manual enrichment for specific lower-priority items by contacting NIST directly via email.

Alongside the new prioritization matrix, NIST is streamlining several operational workflows to reduce duplicate efforts and manage existing queues.

The agency will stop assigning its own severity scores to vulnerabilities if the submitting CVE Numbering Authority has already provided one.

Additionally, NIST is modifying its approach to update vulnerabilities. The NVD team will now only reanalyze modified entries if the new changes materially impact the existing enrichment data.

Because of this procedural shift, thousands of previously deferred vulnerabilities will be reclassified into a “Modified After Enrichment” status in batches over the coming weeks.

To address the significant backlog that began accumulating in early 2024, NIST is moving all unenriched submissions published before March 1, 2026, into a “Not Scheduled” category.

The agency clarified that this backlog excludes CISA KEV entries, which are given priority processing under its long-standing risk management framework.

To improve transparency during this transition, NIST has also updated the NVD Dashboard to report real-time processing statistics and introduced new status labels to communicate where each vulnerability currently sits in the pipeline clearly.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.