CVE Tracking in 2026: Prioritize When NVD Stops Scoring

On April 15, 2026, NIST stopped pretending it could analyze every CVE. The National Vulnerability Database moved to a triage model: enrichment now goes first to vulnerabilities already in CISA’s Known Exploited Vulnerabilities catalog, then to CVEs affecting federal government software, then to critical software as defined by Executive Order 14028. Everything else is categorised “Lowest Priority — not scheduled for immediate enrichment,” and the backlog of records with an NVD publish date earlier than March 1, 2026 was recategorised as “Not Scheduled” in batches over the following two weeks.

For anyone whose vulnerability program reads a CVSS score out of the NVD and sorts the queue by it, that is a load-bearing dependency quietly removed. This is not a temporary backlog announcement. It is a permanent change in what the NVD promises to deliver.

What Actually Changed

The numbers behind the decision are not subtle. NIST’s own statement puts CVE submission growth at 263 percent between 2020 and 2025, with first-quarter 2026 volume running nearly a third above the same period a year earlier. NIST enriched close to 42,000 CVEs during 2025 — roughly 45 percent more than in any prior year — and still lost ground.

Three concrete changes matter operationally:

1. Enrichment is now conditional. A CVE gets NVD analysis if it is in KEV, affects federal software, or falls into the EO 14028 critical-software categories: identity and access management, operating systems, hypervisors and containers, browsers, endpoint and network security tooling, remote access and monitoring software, and backup and storage.
2. KEV entries get a one-business-day target. That is the fastest lane the NVD now offers, and it is the lane that matters most for triage.
3. NIST will not routinely add its own severity score when a CVE Numbering Authority already supplied one. The CNA score becomes the score. CNA scoring quality varies enormously by vendor, and there is no longer a second pass to normalize it.

Recorded Future’s analysis of the change projects that the prioritized categories will cover only 15 to 20 percent of anticipated CVE volume going forward. The practical reading: for roughly four out of five new CVEs, the NVD is now a record-keeping service, not an analysis service.

The CVSS-First Queue Was Already Broken

It is worth being honest that the NVD change exposes a weakness rather than creating one. Sorting a remediation queue by CVSS base score has never been an efficient use of engineering hours, because CVSS measures the worst-case severity of a flaw in the abstract, not the likelihood that anyone will attack it in your environment.

The research published with EPSS v4 in March 2025 puts a number on the waste. Prioritizing everything scored CVSS 7.0 or above means remediating 50.7 percent of published CVEs to reach 74.6 percent coverage of vulnerabilities that are actually exploited — an efficiency of about 6 percent, meaning roughly 94 of every 100 patches in that queue address something nobody attacks. EPSS v4 holds comparable coverage at 6 percent effort, which lifts efficiency to 47 percent: more than an eightfold reduction in work for the same result.

The counter-argument deserves airtime: EPSS predicts observed exploitation in the next 30 days, and observation is biased toward what commercial sensors and honeypots can see. A vulnerability in a narrowly deployed appliance targeted by one state-aligned crew may never generate enough signal to move its EPSS score, while being precisely the thing that ends your quarter. EPSS is a volume-optimization tool for the long tail. It is not a substitute for knowing what is exposed at your own edge.

Four Signals, Four Different Questions

The mistake behind most stalled vulnerability programs is treating these as competing scores rather than as answers to different questions.

A defensible queue uses all four: CVSS for blast radius, KEV as a hard interrupt, EPSS to rank the residual mass, and SSVC-style decision logic to convert the result into act, schedule, or defer. VulnCheck puts 28.96 percent of 2025’s KEV entries as exploited on or before the day their CVE was published, up from 23.6 percent the year before, which is why KEV membership has to function as an interrupt rather than a sort key.

Rebuilding the Pipeline Without NVD Enrichment

A CVE tracking pipeline that survives the change looks different from one built in 2022. The dependency order inverts: exploitation evidence leads, severity follows.

Ingest from the CVE Program, not from NVD enrichment. CVE Record Format 5.1 JSON published by the CVE Program carries the CNA-supplied description, affected-product ranges, and increasingly the CNA’s own CVSS vector. The official cvelistV5 mirror syncs from the CVE Services API about every seven minutes, with hourly delta bundles published as release assets for anyone who would rather pull a diff than watch a repository. Treat that as the spine of the record and stop blocking on NVD analysis that may never arrive.

Overlay KEV on a daily pull. The CISA KEV catalog is published as JSON and CSV. A KEV addition should page the on-call queue owner, not appear in next month’s report. Federal remediation due dates in the catalog are a useful external clock even for organizations with no obligation to meet them.

Overlay EPSS daily and store the history. Scores are rescored every day. The interesting signal is not the absolute value but the delta: a CVE that jumps from 0.02 to 0.4 inside a week is telling you something changed in the wild, usually a public exploit or a mass-scanning campaign.

Resolve affected-product ranges against your own asset inventory before scoring anything. This is the step most programs skip, and it is the one that turns a global feed into a local decision. A CVSS 9.8 in a product you do not run is a zero.

Record which signal drove each decision. When an auditor or an incident review asks why a CVE sat for six weeks, “it was not in KEV, EPSS held under 0.01, and it was not internet-facing” is a defensible answer. “It was CVSS 7.4” is not.

Closing the ticket is still not the same as closing the exposure. That is the failure mode documented in most remediation programs never confirm the fix actually worked: programs are measured on ticket throughput, and nothing in a ticket workflow requires proving the attack path is gone. A better-prioritized queue that still closes without revalidation produces a smaller pile of unverified claims, not a verified one.

Where the Triage Tool Fits

Tech Sentinel publishes Patch Priority Triage, an interactive filter over a curated advisory corpus. You select your operating systems, edge appliances, and application stack, mark whether those systems are internet-exposed, and every advisory is ranked act now, schedule, monitor, or ignore against a published score.

The weighting is deliberately open: CISA KEV membership adds 50, reported active exploitation adds 35 when the CVE is not already in KEV and nothing when it is, a public proof-of-concept adds 15, ransomware association adds 20, an advisory touching internet-exposed surface adds 12, a match against a system you flagged as exposed adds 13, and the rounded CVSS value is added on top. A score of 70 or above returns act now, 40 or above returns schedule, 20 or above returns monitor. Expanding any verdict shows the exact reasons that produced it.

Two honest limitations. The corpus is curated rather than exhaustive, and the score does not currently incorporate EPSS — pull that separately from FIRST for anything the tool ranks below act now. Every row links to NVD and the KEV catalog because the underlying data is point-in-time and must be verified before you act on it.

The same weighting logic is why Emergency Directive 26-03 sat at the top of the queue the week it landed: a CVSS 10.0 authentication bypass on an internet-facing controller, in KEV, with CISA instructing agencies to patch and then hunt. The month-by-month pattern across this month in security: May 2026 is the same shape repeated — several flaws were already in the exploited catalog on the day they were published.

What Defenders Should Do

1. Audit every integration that reads a CVSS score from the NVD API. Anything that silently returns null or a stale value for post-March 2026 records needs a fallback to the CNA-supplied vector today, not at the next tooling refresh.
2. Promote KEV from a report column to an interrupt. A new KEV entry matching your asset inventory should generate a page, with a defined owner and a clock.
3. Add EPSS to the queue and keep 90 days of score history. Rank on the current score; alert on the delta.
4. Rebuild SLAs around exploitation evidence rather than severity bands. “Critical within 15 days” is a policy written for a world where CVSS was the only signal available.
5. Make asset resolution a gate, not a report. A CVE that cannot be matched to an inventory item is an inventory finding, and it should be tracked as one.
6. Add revalidation to closure criteria. Prioritization decides what you fix first; it says nothing about whether the fix held.
7. Expect CNA scoring drift. With NIST no longer normalising, compare CNA vectors against your own reading for anything you are about to declare low.

Related across the network

• Most Remediation Programs Never Confirm the Fix Actually Worked — the validation gap that sits downstream of every prioritization decision
• Cisco SD-WAN and Emergency Directive 26-03 — what a genuine act-now advisory looks like
• AI Agents Are Rewriting the Threat Model for Security Teams — why exploitation timelines keep compressing