NIST’s New Approach to Streamlining Flaw Prioritization in Response to Increased Volume

NIST to Cease Rating Non-Priority Vulnerabilities Due to Increased Volume

The National Institute of Standards and Technology (NIST) has announced that it will no longer assign severity scores to lower-priority vulnerabilities. This decision comes as a result of the growing workload stemming from the rise in submission volumes.

Effective April 15, NIST will only provide detailed analysis, including severity ratings and product lists, for security issues that meet specific criteria related to the level of risk they pose.

While the National Vulnerability Database (NVD) will continue to list all submitted vulnerabilities, those categorized as low priority will only receive a severity rating from the CVE Numbering Authority (CNA) that assessed and submitted them.

NIST Criteria for Vulnerability Analysis

In its recent announcement, NIST outlined specific criteria for vulnerabilities that will receive additional details:

• Presence in CISA’s Known Exploited Vulnerabilities (KEV) catalog
• Impact on U.S. federal government software
• Association with critical software as defined by Executive Order 14028

NIST cited the overwhelming number of submissions, which have surged by 263% recently and continued to rise in 2026, as the primary reason for this decision. Despite enriching 42,000 CVEs in 2025, NIST is struggling to keep pace with the escalating volume.

The NVD, a publicly accessible database of known software and hardware vulnerabilities, offers detailed descriptions and analyses in addition to the CVE IDs provided by CNAs like The MITRE Corporation and vendors.

Enhancing Vulnerability Details for Effective Risk Management

The purpose of enriching vulnerability details is to facilitate risk management by assigning severity scores, identifying affected product versions, classifying weaknesses, and providing links to advisories, patches, or related research.

Widely utilized by security researchers, software vendors, government agencies, IT professionals, journalists, and general users seeking information on security issues, NIST NVD serves as a valuable resource.

NIST clarified that all submitted CVEs will still be included in the NVD. However, those not meeting the specified criteria will be labeled as “Not Scheduled.” This strategic approach allows NIST to concentrate on CVEs with the potential for widespread impact.

Recognizing the possibility of high-impact CVEs slipping through under the new guidelines, NIST welcomes enrichment requests for “any lowest priority CVEs” via email at ‘nvd@nist.gov.’

Despite noticeable delays in enrichment or lack thereof since 2024, NIST has formally declared its commitment to prioritizing the most critical entries.