In April 2026, NIST reclassified roughly 30,000 vulnerabilities in the National Vulnerability Database as "Not Scheduled." If your team relied on NVD as your single source of truth, you just lost visibility into a third of your attack surface overnight.
This wasn't a breach. It was a system failure that exposed how fragile our vulnerability management infrastructure has become.
What Happened
NIST's National Vulnerability Database, the authoritative source for CVE enrichment data, couldn't keep up with the volume of new disclosures. Disclosed vulnerabilities increased 92% in 2025 compared to 2024. The backlog grew until NIST decided to reclassify 30,000 entries as "Not Scheduled" rather than continue the pretense that enrichment was coming.
Organizations relying solely on NVD for CVSS scores, affected product lists, and remediation guidance suddenly found themselves making patch decisions with incomplete data. The vulnerabilities still existed. The CVE IDs were still valid. But the enrichment metadata that feeds your scanner, your CMDB, and your risk scoring engine? Gone.
Timeline
2024-2025: Vulnerability disclosures surged 92% year-over-year. AI-assisted security research accelerated the discovery of bugs in open-source libraries, cloud services, and embedded systems.
Early 2026: NVD enrichment delays stretched from days to weeks, then months. Security teams noticed CVEs appearing in their scanners without CVSS scores or affected version ranges.
April 2026: NIST reclassified 30,000 vulnerabilities as "Not Scheduled." No enrichment data. No timeline for completion. Organizations that built SLAs around "critical vulnerabilities must be patched within 30 days" couldn't determine which vulnerabilities were critical.
Which Controls Failed
Single Point of Failure: Most vulnerability management programs treat NVD as the only authoritative source. When NVD enrichment stops, the entire risk assessment process stalls. This violates the redundancy principle in NIST 800-53 Rev 5 Control SI-5, which requires organizations to receive security information from multiple sources.
No Fallback Intelligence: Teams lacked alternative sources for CVSS scoring, exploit availability, or affected product versions. When NVD data wasn't available, there was no process to pull equivalent data from vendor advisories, threat intelligence feeds, or community databases like OSV.
Rigid SLA Definitions: Patch management policies tied to CVSS scores became unenforceable. If you can't determine whether a CVE is critical or low, you can't apply your 30-day vs. 90-day remediation windows. PCI DSS v4.0.1 Requirement 6.3.1 requires risk-based patch management, but "risk-based" assumes you can calculate risk.
Automation Brittleness: Scanners, ticketing systems, and dashboards that consumed NVD data directly broke or displayed incomplete information. Teams discovered their automation had no error handling for missing enrichment data.
What the Standards Require
NIST 800-53 Rev 5 SI-5 states organizations must "receive system security alerts, advisories, and directives from designated external organizations on an ongoing basis." Note the plural: organizations. The control assumes you're not dependent on a single feed.
ISO/IEC 27001:2022 Annex A.8.8 (Management of Technical Vulnerabilities) requires organizations to obtain timely information about technical vulnerabilities and evaluate exposure. "Timely" means you can't wait indefinitely for NVD enrichment. You need alternative sources.
PCI DSS v4.0.1 Requirement 6.3.1 mandates identification and ranking of vulnerabilities based on industry-recognized risk ratings. If NVD isn't providing those ratings, you're required to find them elsewhere or develop your own risk assessment methodology.
SOC 2 Type II CC7.1 requires monitoring of system components to detect security incidents. If your monitoring depends entirely on NVD-enriched CVE data, you've created a blind spot that auditors will flag.
Lessons and Action Items
Build a Multi-Source Intelligence Model
Stop treating NVD as your only feed. Add:
- Vendor-specific security advisories (Red Hat, Microsoft, AWS)
- GitHub Security Advisories for open-source dependencies
- CISA Known Exploited Vulnerabilities catalog
- Commercial threat intelligence feeds
Configure your vulnerability management platform to merge data from multiple sources. When NVD lacks a CVSS score, pull it from the vendor advisory. When NVD lacks exploit status, check CISA KEV.
Define Fallback Risk Criteria
Write a procedure for handling unenriched CVEs. If a vulnerability has a CVE ID but no CVSS score, how do you prioritize it? Options:
- Treat it as "medium" by default and escalate if it appears in exploit databases
- Manually score it using the CVSS calculator based on vendor advisory details
- Prioritize based on affected asset criticality rather than vulnerability severity
Document this in your vulnerability management policy. Make it auditable.
Test Your Automation's Error Handling
Simulate missing NVD data. What happens when your scanner encounters a CVE with no CVSS score? Does it fail silently? Display "Unknown"? Generate a ticket with incomplete data?
Fix the gaps. Your automation should flag unenriched CVEs for manual review rather than ignoring them or treating them as low-risk by default.
Decouple SLAs from CVSS Alone
Rewrite patch management SLAs to account for multiple risk factors:
- Is the vulnerability in CISA KEV?
- Is there a public exploit?
- What's the asset's business criticality?
- Is the vulnerable component internet-facing?
CVSS is one input, not the only input. This approach aligns with PCI DSS v4.0.1's risk-based methodology and makes your program resilient when enrichment data is delayed.
Track Enrichment Lag as a Metric
Measure how long it takes for CVEs to receive enrichment data from each source. If NVD averages 45 days and GitHub Security Advisories average 3 days for open-source libraries, you know which source to prioritize for your stack.
Use this data to justify budget for commercial feeds or additional tooling. When you can show leadership that 30% of your CVEs lack actionable data for six weeks, the ROI for redundant intelligence sources becomes obvious.
The April 2026 reclassification wasn't an anomaly. It was a preview of what happens when discovery outpaces enrichment. Your vulnerability management program needs to work when the authoritative source doesn't.
