The National Vulnerability Database ingests new CVEs almost continuously — a newly published CVE usually appears within about an hour — but ingestion and enrichment are two different clocks. As of April 15, 2026, NIST no longer enriches every CVE with a CVSS score, CWE classification, and CPE product data. It prioritizes only CVEs in CISA's Known Exploited Vulnerabilities catalog (targeted within one business day), federal-government software, and Executive Order 14028 "critical software" — an estimated 15–20% of all CVEs. Everything else is flagged "Lowest Priority — not scheduled for immediate enrichment" and may never get an official NVD score.
That is the summary an AI overview can give you. Here is what it can't: why the two clocks diverged, exactly which status each record can land in, who now fills the enrichment gap NIST walked away from, and how to build a vulnerability program that doesn't depend on a NIST severity score that may never arrive. If you take one thing away, take this — treating "no NVD CVSS score" as "not urgent" was always a mistake, and in 2026 it is a dangerous one.
This article explains how the NVD update process actually works, what changed in 2024–2026, and the practical strategies security teams use to work within the new constraints.
How the NVD Works: The CVE Lifecycle
To understand update frequency, it's helpful to understand the relationship between MITRE's CVE List and NIST's National Vulnerability Database:
Step 1: CVE Assignment (MITRE)
When a security researcher or vendor discovers a vulnerability, they request a CVE ID from a CVE Numbering Authority (CNA). MITRE maintains the authoritative CVE List, which provides:
- Unique CVE identifier (e.g., CVE-2025-12345)
- Brief description of the vulnerability
- References to advisories, reports, or patches
- Affected product information
This is the "base" CVE record—essential for tracking and communication, but lacking detailed severity scoring and analysis.
Step 2: CVE Publication
Once assigned and disclosed, the CVE is published to the CVE List. The NVD ingests these new CVEs automatically.
Step 3: NVD Enrichment (NIST)
NIST analysts enhance CVE records with additional data:
- CVSS Scores: Detailed severity ratings (Base, Temporal, and Environmental scores)
- CWE Mappings: Classification by weakness type (e.g., SQL injection, buffer overflow)
- CPE Strings: Standardized product identifiers showing affected software versions
- Additional References: Links to exploit databases, vendor advisories, and mitigation guidance
- Configuration Analysis: Details about vulnerable configurations
This enrichment transforms a basic CVE record into an actionable intelligence report that security teams can use for risk assessment and remediation planning — when it happens.
The lifecycle at a glance
| Stage | Who runs it | Typical timing | What you get | Authoritative source |
|---|---|---|---|---|
| 1. ID assignment | CNA (via MITRE/CVE.org) | Seconds to reserve | A CVE ID, reserved | CVE List |
| 2. Publication | CNA | On public disclosure | Description, references, affected product | CVE List / CVE.org |
| 3. NVD ingestion | NIST (automated) | Within ~1 hour of publication | Record searchable in NVD; still no severity | NVD |
| 4. NVD enrichment | NIST analysts | 1 business day (KEV) → weeks → never for most | CVSS score, CWE mapping, CPE strings, configs | NVD (if prioritized) |
| 4b. ADP enrichment | CISA Vulnrichment | Ongoing, in parallel | SSVC decision points, sometimes CVSS/CWE | CVE.org ADP container |
The critical shift: stages 1–3 are automatic and reliably fast. Stage 4 — the analysis that produces the CVSS number most tools key off — is no longer guaranteed to happen at all.
NVD Update Frequency: Real-Time CVE Ingestion
The good news: CVE ingestion into the NVD is nearly real-time.
According to NIST, the NVD processes the CVE List every hour to identify new CVE publications, rejections, or modifications. New CVEs are typically available in the NVD within one hour of publication to the MITRE CVE List.
This means if a vendor discloses a vulnerability at 9:00 AM, it should appear in the NVD database (with basic information) by 10:00 AM. You can query the NVD via its web interface or API and see the new CVE record almost immediately.
API and Feed Update Schedules
The NVD provides data through multiple channels with different update frequencies:
NVD API (Recommended):
- Updated as frequently as the website
- Real-time access to the latest data
- Rate limited but suitable for automated queries
JSON Data Feeds (Legacy — now retired):
- The legacy JSON 1.1 vulnerability data feeds ("Recent," "Modified," and per-year files) were retired in 2025. If your tooling still points at those static feed URLs, it stopped receiving updates.
- The replacement is the NVD REST API (the CVE 2.0 endpoint and related metadata/CPE endpoints), which returns the same data with date-range filtering and real-time freshness.
For production vulnerability management systems, the NVD API provides the most current data with the best performance characteristics. You can query any single CVE and see exactly which enrichment fields NIST has (or has not) populated:
The Enrichment Challenge: From Hours to Months
While CVE ingestion happens within an hour, enrichment with CVSS scores and detailed analysis takes considerably longer—and for most CVEs, no longer happens at all. This is where the NVD's 2024–2026 crisis lives.
From backlog to triage: what changed in 2024–2026
The backlog opened in early 2024, when NIST abruptly slowed CVE analysis and a growing pile of records sat un-enriched. Through 2024 and 2025 NIST tried to dig out — it enriched nearly 42,000 CVEs in 2025, about 45% more than any previous year — but it never caught up. The reason is simple math: CVE submissions rose roughly 263% between 2020 and 2025, and submissions in the first quarter of 2026 ran nearly one-third higher than the same period a year earlier. You cannot out-hire an exponential.
So in April 2026, NIST stopped trying to enrich everything. It formally moved to a triage model. This is the single most important fact for anyone building a vulnerability program today, and it is why guidance written before 2026 is now misleading.
What NIST still enriches (prioritized tiers):
| Tier | Target timeline | Rationale |
|---|---|---|
| CVEs in CISA's KEV catalog | Within 1 business day of receipt | Known to be exploited in the wild |
| Federal-government software CVEs | Prioritized | Direct government exposure |
| EO 14028 "critical software" CVEs | Prioritized | Executive-order-designated critical software |
| Everything else | Not scheduled | Flagged "Lowest Priority" — may never be enriched |
Industry estimates put the prioritized categories at only about 15–20% of anticipated CVE volume. The other ~80% of new CVEs will carry no NIST-provided CVSS score, CWE mapping, or CPE data unless and until they later enter the KEV catalog or NIST reprioritizes.
NIST also discontinued routine independent severity scoring and narrowed its reanalysis of changed records to only "materially impactful" modifications. And it retroactively cleared the queue: all backlogged CVEs published before March 1, 2026, were moved to a "Not Scheduled" state, to be reconsidered only "as resources allow." (This supersedes the earlier 2025 move that marked pre-2018 CVEs as "Deferred" — the cutoff line has walked forward to essentially the present.)
Enrichment timeline: what to expect now
The old "hours to weeks" framing is gone. In 2026 the timeline is dictated by which tier a CVE lands in:
KEV / prioritized CVEs: Enriched fast — NIST targets one business day for KEV entries. If a CVE is being actively exploited, expect a NIST CVSS score quickly.
Everything else: Assume it will not be enriched by NIST at all. The record exists and is searchable, but the CVSS/CWE/CPE fields stay empty unless the CVE is later escalated. Planning around a NIST score arriving "eventually" is no longer a safe assumption.
The CPE gap is worse than the CVSS gap
Even before the 2026 cutback, CPE coverage lagged. Only about 57.6% of 2025 CVEs included CPE identifiers (versus over 90% for CVSS and CWE among enriched records), and independent analysis of 2024 data found NVD supplied CPE strings for only ~41% of published CVEs. CPE is what lets a scanner automatically match a CVE to the exact software versions you run — so the CPE gap directly breaks automated matching, quietly, even for records that got a severity score.
What Affects Enrichment Speed?
Several factors influence how quickly a CVE receives enrichment:
Complexity: Some vulnerabilities require extensive research and testing to determine accurate CVSS scores and affected configurations. A simple SQL injection is faster to analyze than a complex race condition in a kernel driver.
Information Availability: If the vendor provides detailed advisories with clear scope and CVSS scores, NIST can enrich the record more quickly. Vague disclosures require more investigation.
Resource Constraints: NIST has a finite number of analysts. When multiple major vulnerabilities are disclosed simultaneously (like a large vendor's monthly patch Tuesday), enrichment times increase.
Volume Spikes: After major security conferences, coordinated disclosure events, or large-scale security research publications, the enrichment backlog grows.
Practical Implications for Security Teams
Understanding these timelines has important implications for vulnerability management:
Don't Wait for CVSS Scores
If a vendor publishes a critical security advisory with patches available, don't wait for NIST enrichment before acting. Vendor advisories usually include their own severity assessments and remediation guidance. Treat vendor-rated "Critical" issues as critical until proven otherwise.
Multiple Data Sources
Build vulnerability intelligence from multiple sources:
- Vendor Advisories: Often the fastest and most authoritative source for new vulnerabilities
- CISA KEV Catalog: Known Exploited Vulnerabilities requiring urgent attention
- Threat Intelligence Feeds: Commercial and open-source feeds providing exploit information
- CVE List (MITRE): Base CVE information before NVD enrichment
- NVD: Comprehensive enriched data when available
Don't rely solely on NVD enrichment—it's one important piece in a broader threat intelligence picture.
Automated Scanning Frequency
Given that the NVD is continuously updated, how often should you scan for new vulnerabilities?
Daily Scanning: For production environments and internet-facing systems, daily vulnerability scans ensure you identify new CVEs affecting your assets within 24 hours of enrichment.
Weekly Review: Dedicate time each week to review new Critical and High severity CVEs affecting your technology stack, even if they haven't yet been detected in scans.
Real-Time Alerting: Configure your vulnerability management tools to alert on specific high-priority criteria:
- CVEs affecting your critical assets
- CISA KEV catalog additions
- Critical/High severity CVEs for your key vendors
Continuous Monitoring: In cloud environments or using modern vulnerability management platforms, continuous monitoring provides real-time visibility as new vulnerabilities are published and enriched.
Understand Data Lag
When reviewing vulnerability reports, check the "Last Modified" date on NVD records. A CVE published months ago with no enrichment may lack critical context. Check the vendor's advisory or security community resources for additional information.
API Best Practices
If you're building automation around the NVD API:
Rate Limiting: The NVD API has rate limits (currently 5 requests per 30 seconds without an API key, 50 requests per 30 seconds with an API key). Design your automation accordingly.
API Keys: Register for a free API key to get higher rate limits and better reliability.
Incremental Updates: Instead of downloading the entire NVD database daily, use the API's date range filters to query only recently modified CVEs (e.g., CVEs updated in the last 24 hours).
Caching: Cache NVD data appropriately. Don't query for the same CVE repeatedly within short time periods.
Error Handling: Build robust error handling for API unavailability, rate limiting, or incomplete data.
Who fills the gap NIST left: CISA Vulnrichment
The most important development for practitioners is not what NIST stopped doing — it is who stepped in. In 2024, CISA became the CVE Program's first-ever Authorized Data Publisher (ADP) and launched the Vulnrichment program specifically to fill the enrichment gap.
Here is how it works and why it matters:
- CISA runs each CVE through an SSVC (Stakeholder-Specific Vulnerability Categorization) decision process, adding decision points for exploitation status, technical impact, and automatability.
- Where the original CNA left gaps, CISA adds CWE identifiers and CVSS scores when it can determine them.
- This data lands in the CVE record's ADP container, so if you pull from the CVE.org API or the CVEProject/cvelistV5 GitHub repo, you are already collecting it — no separate feed required.
Practically, this means the "source of truth" for enrichment is shifting away from the NVD and toward the CVE.org record itself, where CNA-provided CVSS scores and CISA's ADP additions live side by side. NIST reflected this too: as of a June 17, 2026 schema update, NVD records can now surface SSVC data sourced from CISA's ADP container alongside any CVSS scores.
CVSS versions and how the NVD displays scores
When NIST does enrich a CVE, it publishes a CVSS Base score. The NVD supports CVSS v4.0 (released by FIRST in November 2023) in addition to the still-widely-used v3.1. Two behaviors are worth knowing:
- CNA scores win ties. If both the CNA and the NVD provide CVSS data and the values match, the NVD displays only the CNA-provided score. Increasingly, the CNA (or CISA's ADP) is the only source of a CVSS score, since NIST no longer scores most CVEs itself.
- Base scores only. Assessment providers like the NVD typically supply Base scores (CVSS-B), not Threat or Environmental metrics — you compute those for your own environment.
What NIST is still doing
Despite the cutback, NIST continues to invest in the NVD platform:
- API-first delivery. The modern NVD REST API replaced the retired legacy JSON feeds and remains the recommended integration path.
- Faster KEV enrichment. By concentrating analyst time on the KEV/critical tiers, NIST can hit its one-business-day target for the vulnerabilities most likely to hurt you.
- Schema expansion. The June 2026 addition of SSVC/ADP data gives records richer, exploitation-aware context than a bare CVSS number.
Working Around Enrichment Delays
While waiting for NVD enrichment, security teams can leverage alternative data sources:
Vendor CVSS Scores
Many vendors provide their own CVSS scores in security advisories. While these should be validated, they provide useful baseline severity information immediately upon disclosure.
Vulners, VulnDB, and Commercial Databases
Commercial vulnerability databases often enrich CVE records faster than NVD, though at a subscription cost. For organizations requiring faster threat intelligence, these services provide value.
Security Community Resources
Platforms like GitHub Security Advisories, vendor-specific security communities, and security researcher blogs often provide detailed analysis of significant vulnerabilities before official enrichment.
Automated Threat Intelligence
Modern vulnerability management platforms aggregate data from NVD, vendor advisories, exploit databases, and threat intelligence feeds to provide comprehensive vulnerability context even when NVD enrichment is pending.
Monitoring the NVD
Stay informed about NVD status and changes:
- NVD News Page: https://www.nist.gov/itl/nvd/nvd-news - Official announcements
- Change Timeline: https://nvd.nist.gov/general/news/change-timeline - Detailed system changes
- NVD Status: Monitor for outages or processing delays
- CVE Statistics: NVD provides statistics on processing rates and backlog
Understanding when the NVD experiences challenges helps you adjust expectations and processes accordingly.
Conclusion
The National Vulnerability Database still provides near-real-time ingestion of new CVEs—typically within one hour of publication—making it an excellent resource for tracking newly disclosed vulnerabilities. But the enrichment process that adds severity scores and detailed analysis fundamentally changed in April 2026: NIST now enriches only a prioritized ~15–20% of CVEs and lets the rest sit unscored. The NVD is, in effect, a triage queue rather than a universal scoring authority.
For security teams, this means:
- Never treat "no NVD CVSS score" as "not urgent." Most CVEs will never get one.
- Don't wait for enrichment before acting on vendor-rated or KEV-listed vulnerabilities.
- Pull from CVE.org, not just the NVD — CNA scores and CISA's Vulnrichment/ADP data live there.
- Prioritize with exploitation signals — CISA KEV, EPSS probability, and vendor severity, not a NIST score's presence or absence.
- Migrate to the NVD API — the legacy JSON feeds are gone.
- Fill gaps with multiple sources — vendor advisories, commercial feeds (VulnCheck, Vulners), and threat intelligence.
The NVD remains a valuable, free, authoritative resource — but it is now one input among several, not the finish line. Programs built on the assumption that "a NIST CVSS score will eventually appear" are quietly broken. The teams that adapt fastest are the ones that already treat enrichment as a multi-source problem.
Ready to explore the latest vulnerabilities and understand CVSS severity ratings? Use our CVE Vulnerability Search & CVSS Calculator to query the NVD database in real-time and access the most current vulnerability intelligence available.