The NVD CVE backlog: what it means for your PSIRT, and what Vulnrichment fills in

NIST's own numbers describe a gap that is widening, not closing. CVE submissions rose 263% from 2020 to 2025, and the first quarter of 2026 ran nearly a third higher than the same period a year earlier. NIST enriched close to 42,000 CVEs in 2025, a record, and still calls that pace insufficient against incoming volume. Effective 15 April 2026, NIST adopted risk-based prioritization criteria rather than first-in-first-out processing:

CVEs published before 1 January 2018 carry a separate "Deferred" status for the same reason — age-based deprioritization, not a judgment that the vulnerability is unimportant. Neither status is a disappearance: a CVE Record still exists and is still a real, assigned identifier. It simply has no NVD-assigned CVSS score or CPE match yet, and for most CVEs outside the three priority categories above, none is coming soon.

Vulnrichment is CISA's own contribution to a CVE Record under the CVE Program's Authorized Data Publisher (ADP) mechanism, launched in 2024. Where NVD enrichment has not yet reached a CVE, CISA's ADP container can independently supply SSVC decision points, a CWE classification where the available detail supports one, a CVSS score, and a flag marking whether the CVE already appears on the KEV catalog. CISA's own project documentation is explicit about the boundary: the ADP container is additive, and "at no point will CISA overwrite the originating CNA's data in the original CNA container in the CVE record." One field CISA previously supplied — CPE match strings — was discontinued from the ADP container as of 10 December 2024, so Vulnrichment today is a severity-and-exploitability signal, not a full substitute for NVD's product-matching data.

Stakeholder-Specific Vulnerability Categorization (SSVC) is the decision framework behind the SSVC fields Vulnrichment adds to a CVE Record, developed by Carnegie Mellon University's Software Engineering Institute in collaboration with CISA. Rather than collapsing a vulnerability into one severity number, SSVC walks through a small set of decision points — whether the vulnerability is being actively exploited, whether exploitation can be automated, the technical impact if exploited, and how prevalent or safety-relevant the affected product is — and resolves them into one of four action categories: Track (no action needed now), Track* (watch more closely), Attend (needs attention from internal supervisory staff), or Act (needs attention up to leadership level). For a PSIRT, SSVC is useful precisely because it does not require NVD's CVSS score to function: a PSIRT can walk the same decision points itself from a vendor advisory or its own analysis, independent of whether NVD or Vulnrichment has published anything yet.

Worth stating plainly, without overclaiming: no, not yet. NIST's April 2026 update describes risk-based triage rules and a commitment to "automated systems and workflow enhancements required for long-term sustainability" — but it frames that automation as something still to be built, not a capability already processing the backlog. There is no claim in NIST's own release of machine learning, large language models or any other AI technique currently doing CVE enrichment work. A PSIRT planning around NVD's output should plan around today's manual, priority-ranked pace — KEV-listed CVEs in roughly a business day, federal and EO 14028 critical software ahead of the general queue, everything else on an indefinite "Not Scheduled" footing — not around automation that has been announced but not shipped.