NVD's April 15 Policy Change: What 90 Days of Delayed Enrichment Means for Your Program

On the morning of April 16, 2026, a vulnerability management analyst at a large financial services firm noticed something unusual in her dashboard: 43 new CVEs published overnight, zero CVSS scores attached. Not a pipeline error. Not a lag. The new normal. NIST had announced the day before that NVD would no longer enrich the majority of CVEs --- only CISA KEV entries, federal information system CVEs, and EO 14028 critical-software CVEs would receive full scoring and CPE matching going forward.

Ninety days later, the data confirms what practitioners feared. The median CVE published since April 15 sits in "Awaiting Analysis" indefinitely. Programs that relied on NVD as their scoring authority --- which is most programs --- are making prioritization decisions without the data those decisions require.

Why Now: 90 Days of Data Proves This Is Permanent

When NVD experienced its 2024 enrichment backlog, the security community treated it as temporary --- a staffing problem, a process hiccup, something that would clear. NIST's April 15 announcement was different. It was not a backlog disclosure. It was a scope reduction. NVD's charter now explicitly covers only three categories of CVEs for enrichment. Everything else is outside their operational mandate.

The 90-day data is unambiguous:

CVEs published since April 15, 2026: approximately 7,800
CVEs receiving full NVD enrichment (CVSS, CPE, CWE): approximately 640 (CISA KEV + federal + EO 14028 critical software)
CVEs remaining in "Awaiting Analysis" or "Not Scheduled": over 90% of the total

This is not a backlog that will clear. This is the new steady state. The majority of the vulnerability ecosystem now publishes with nothing more than a CNA-submitted description and, if you are lucky, a CNA-assigned CVSS vector that may or may not reflect your environment.

For organizations that built their vulnerability management pipelines around NVD as the enrichment authority --- feeding CVSS scores into SLA policies, populating CPE matches into asset correlation, driving CWE classifications into root-cause analysis --- the pipeline is running on partial data. Decisions are being made. They are just being made blind.

What Exactly Changed on April 15

NIST's announcement was characteristically understated, but the operational impact is severe. Here is the precise scope change:

Before April 15: NVD attempted to enrich all published CVEs with CVSS base scores, CPE match criteria (which software versions are affected), and CWE classifications (what type of vulnerability). Backlogs existed, but the intent was comprehensive coverage.

After April 15: NVD enriches only:

CVEs listed in the CISA Known Exploited Vulnerabilities (KEV) catalog
CVEs affecting federal information systems (as determined by NIST)
CVEs in software designated as EO 14028 critical software

Everything else receives no NVD-assigned CVSS, no CPE matching, and no CWE classification. CNA-submitted data (from the vendor or researcher who reported the vulnerability) passes through, but NVD adds nothing to it.

Why This Matters More Than You Think

The CNA-submitted data that remains is not equivalent to NVD enrichment. Three critical gaps:

CPE matching. CNAs rarely provide formal CPE identifiers. NVD's CPE matching --- telling you exactly which software versions, configurations, and platforms are affected --- is what enables automated correlation between vulnerability data and asset inventories. Without it, the connection between "this CVE exists" and "this CVE affects my environment" becomes a manual research exercise for every single vulnerability.

Consistent scoring methodology. NVD applied CVSS using a consistent methodology across all CVEs. CNA-assigned scores vary wildly in quality --- some vendors consistently underscore their own vulnerabilities (nobody wants to publish a 9.8 against their own product), while some researchers consistently overscore to attract attention. NVD normalization is gone.

CWE classification. Root-cause analysis at scale (which vulnerability classes dominate your environment?) depends on consistent CWE tagging. Without it, vulnerability management becomes purely reactive --- you cannot identify systemic weakness patterns.

The CVEs That Prove the Problem

Consider two real-world examples that illustrate what delayed enrichment actually costs:

CVE-2024-3094 (xz backdoor). This supply-chain compromise --- the culmination of a years-long infiltration campaign --- sat in open-source build tools for weeks before discovery. When it was finally identified, the severity was immediately clear to the security community --- but NVD enrichment lagged behind community consensus by weeks during the 2024 backlog. Under the new policy, a similar supply-chain vulnerability in non-critical-software would receive no NVD enrichment at all unless CISA added it to KEV. The delta between "this exists" and "this is scored and matchable" would be indefinite rather than delayed.

CVE-2024-21762 (FortiOS RCE). Widely exploited in the wild. CISA added it to KEV. Under the new policy, this CVE would receive enrichment --- because it hit KEV. But consider the timeline: exploitation was observed before KEV addition. Organizations without alternative enrichment sources were blind during the window between disclosure and KEV listing. That window is where attackers operate.

The pattern is clear: KEV-listed CVEs still get enriched (eventually), but the CVEs actively being exploited before they hit KEV --- the ones you most need to prioritize --- are exactly the ones that now fall through the NVD gap.

What This Means for Your Vulnerability Management Program

SLA Policies Anchored on CVSS Are Now Partially Blind

If your vulnerability management SLAs read "Critical (CVSS 9.0-10.0): remediate within 72 hours" and you rely on NVD for that CVSS score, over 90% of new vulnerabilities cannot be classified under your own policy. They have no score. They sit in an indefinite limbo --- not Critical, not High, not anything --- until someone manually researches them or an alternative source provides scoring.

The operational impact: either you allocate analyst time to manually score every unenriched CVE (unsustainable at 7,000+ per quarter), or you accept that most vulnerabilities bypass your SLA framework entirely. Neither outcome is acceptable for a mature program.

Asset Correlation Breaks Without CPE Data

Automated vulnerability-to-asset correlation depends on CPE matching. Without NVD-provided CPEs, your vulnerability scanner may detect a CVE via signature matching, but enrichment-driven workflows (which assets are affected? what's the blast radius?) lose their data source for the majority of published vulnerabilities.

This affects everything downstream: risk-based prioritization models, exposure dashboards, board-level reporting on vulnerability posture, and compliance evidence generation for frameworks that require vulnerability management documentation.

CISA BOD 26-04 Assumes Data NVD No Longer Provides

CISA's Binding Operational Directive 26-04, issued June 10, 2026, replaces blanket severity-based patching timelines with risk-based remediation requirements. Agencies must prioritize based on exploitation probability, asset criticality, and business impact. Those three inputs require:

Exploitation probability: EPSS scores, threat intelligence feeds, KEV status
Asset criticality: Organizational asset classification
Business impact: Environmental context mapping

NVD provided the foundation that made the first input possible at scale (CVSS + CPE = "this vulnerability affects these assets at this severity"). With that foundation degraded, BOD 26-04 compliance requires alternative enrichment sources. The directive does not say "wait for NVD." It says "prioritize based on risk." If you lack the data to assess risk, you are non-compliant.

Alternatives That Actually Work

The NVD gap is not a dead end. Multiple enrichment approaches can fill it --- the question is which combination provides coverage, timeliness, and reliability equivalent to what NVD used to offer.

EPSS (Exploitation Prediction Scoring System)

FIRST's EPSS model provides daily exploitation probability predictions for every CVE. It does not replace CVSS (it measures likelihood, not severity), but it answers the question NVD never answered: "Is anyone likely to exploit this?" An EPSS score above 0.3 (a 30% predicted probability of exploitation within 30 days) combined with any exploitation indicator is a stronger priority signal than a CVSS 9.8 with no exploitation activity.

CNA-Submitted Scoring

Vendors and researchers increasingly submit CVSS vectors directly to CVE.org during the reservation process. Quality varies, but coverage is growing. Treat CNA-submitted scores as a lower-confidence input that requires validation rather than as authoritative.

CISA KEV Catalog

The KEV catalog remains the gold standard for "this is being actively exploited --- patch now." Its limitation is coverage: KEV tracks on the order of a thousand-plus CVEs cumulatively, while thousands are exploited every year. KEV is a must-act list, not a comprehensive exploit-status source.

Multi-Source Enrichment Pipelines

The sustainable answer is aggregation: combining NVD (where available), CNA-submitted data, EPSS, KEV, vendor advisories, exploit database monitoring (Metasploit, Exploit-DB, Nuclei templates), and OSV.dev into a single enriched record per CVE. No single source covers the gap NVD left. A multi-source pipeline that correlates across 12+ upstream feeds can deliver sub-3-hour enrichment where NVD now delivers nothing.

Vendor Advisory Monitoring

Major vendors (Microsoft, Cisco, Fortinet, Palo Alto Networks) publish their own CVSS scores and affected-version data faster than NVD ever did. Integrating vendor advisory feeds directly --- rather than waiting for NVD to ingest and normalize them --- provides both coverage and timeliness for your specific technology stack.

The Contrarian Position: NVD's Decline Is Overdue Correction

Here is the opinion that will draw pushback: the security community's dependence on NVD was always a single point of failure, and that failure was inevitable.

NVD was never designed to be the world's vulnerability intelligence service. It was a government catalog. The community built an entire ecosystem --- scanners, prioritization models, SLA policies, compliance frameworks --- on the assumption that one government program would score every vulnerability on earth in a timely manner. That assumption was always fragile. April 15 made it explicit.

The organizations that will navigate this well are those that treat vulnerability intelligence like any other critical dependency: diversified, multi-sourced, and validated. The organizations that will struggle are those hoping NVD's scope will expand again. It will not. The policy change reflects resource constraints that are structural, not temporary.

Key Takeaways

NVD's April 15 policy change is permanent. Over 90% of new CVEs now receive no NVD enrichment. This is a scope reduction, not a backlog.
CVSS-anchored SLAs are partially broken. If your policy depends on NVD-assigned scores, most vulnerabilities cannot be classified under your own framework.
CPE matching loss breaks asset correlation. The link between "CVE exists" and "CVE affects my systems" requires alternative data sources for non-KEV vulnerabilities.
BOD 26-04 assumes enrichment data NVD no longer provides. Risk-based prioritization requires multi-source intelligence, not single-source CVSS.
Multi-source aggregation is the only sustainable model. EPSS + KEV + CNA-submitted + vendor advisories + exploit databases = coverage. No single alternative replaces NVD alone.

Frequently Asked Questions

Will NVD resume enriching all CVEs if they get more funding?

There is no indication this will happen. The April 15 policy change was presented as a deliberate scope decision, not a temporary resource constraint. NIST's communication framed the change as sustainable prioritization of their limited enrichment capacity on the highest-impact vulnerabilities. Planning as if NVD will return to full coverage is a risk your program should not take.

Does CISA KEV cover enough vulnerabilities to replace NVD for prioritization?

No. KEV tracks actively exploited vulnerabilities that meet CISA's evidence standards --- currently well over a thousand entries. Thousands of CVEs are exploited annually without meeting KEV's inclusion threshold. KEV is a must-act list, not a comprehensive enrichment source. Use it as one input alongside EPSS, vendor advisories, and exploit database monitoring.

How does this affect compliance frameworks that reference CVSS scores?

Frameworks like CMMC, FedRAMP, and PCI DSS reference vulnerability severity in remediation timeline requirements but do not mandate NVD as the scoring authority. Organizations can satisfy compliance requirements using any defensible vulnerability scoring methodology --- including multi-source enrichment, EPSS-augmented prioritization, or vendor-supplied scoring. Document your methodology and its data sources for auditor review.

What should we do about the CVEs in our backlog that have no CVSS score?

Triage them using available signals: EPSS score (exploitation likelihood), KEV status (confirmed exploitation), vendor advisory severity (vendor's own assessment), and exploit database presence (proof-of-concept availability). CVEs with EPSS above 0.1 and any exploitation indicator should be prioritized regardless of missing NVD scores. CVEs with no signals across all sources can be deprioritized until additional context emerges.

Is the CNA-submitted CVSS data reliable enough to use for prioritization?

It varies by CNA. Major vendor CNAs (Microsoft, Red Hat, Cisco) generally provide quality scoring. Smaller CNAs and individual researchers may under- or over-score. Treat CNA-submitted scores as a starting point that should be validated against additional context --- EPSS, exploitation evidence, and asset criticality --- rather than as a standalone priority signal.

How Advisedly Helps

Advisedly's live CVE feed was built specifically for the post-NVD reality --- aggregating 12+ upstream sources into a single enriched record per CVE with sub-3-hour enrichment, EPSS integration, KEV correlation, and exploit-availability tracking that maps directly to your asset inventory and compliance obligations across 500+ frameworks. When NVD provides nothing, the platform still delivers the scoring, context, and prioritization data your program requires. begin@advisedly.ai