Notifications
Clear all
Topic starter
01/08/2026 10:43 pm
TL;DR: A federal OIG audit found the National Vulnerability Database backlog exceeded 27,000 unprocessed vulnerabilities, while annual disclosures are projected to surpass 60,000 in 2026, according to NowSecure. The queue is a symptom of a broader shift: security teams increasingly need exploitability-first prioritisation, continuous testing and supply-chain visibility before full analysis arrives.
NHIMG editorial — based on content published by NowSecure: the NVD backlog and vulnerability management strain analysis
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes.
Questions worth separating out
Q: How should security teams prioritise vulnerabilities when remediation capacity is limited?
A: Prioritise by exposure, business criticality, and the identities attached to the affected asset.
Q: Why do third-party SDKs create blind spots in vulnerability management?
A: Third-party SDKs can introduce behavioural, privacy and supply-chain risks that never become a CVE.
Q: What do security teams get wrong about CVE coverage?
A: They often assume that if a risk matters, it will appear in a database and receive equal analysis.
Practitioner guidance
- Prioritise exploitability over severity Use EPSS and CISA KEV alongside asset criticality, internet exposure and business impact so the highest-risk issues move first.
- Inventory third-party dependencies and SDKs Maintain an inventory of packages, SDKs, APIs and commercial components in every production app, then map them to business owners and runtime permissions.
- Continuously test software behaviour Add runtime and pre-production testing that looks for unexpected network calls, data collection and privilege use, especially in mobile apps and embedded SDKs.
What's in the full article
NowSecure's full analysis covers the operational detail this post intentionally leaves for the source:
- How the OIG audit quantified the NVD backlog and the projected disclosure growth rate.
- The article's explanation of why NIST narrowed analysis scope and how that changes prioritisation.
- Examples of software supply-chain exposure that may never receive a CVE, including runtime behaviour cases.
- The practical mobile security testing and dependency visibility measures NowSecure recommends.
👉 Read NowSecure's analysis of the NVD backlog and vulnerability management strain →
NVD backlog and CVE volume: is vulnerability management keeping up?
Explore further
01/08/2026 10:53 pm
Exploitability is becoming the real control plane for vulnerability management: once backlog growth outpaces enrichment, CVSS-only prioritisation stops being operationally useful. Security teams need to decide which issues matter before the database has finished describing them. That changes vulnerability management from a records problem into a decision-speed problem. Practitioners should treat exploitability signals and asset criticality as the primary governance lens.
A question worth separating out:
Q: How can teams reduce exposure while waiting for full vulnerability analysis?
A: Teams should isolate high-risk assets, reduce reachable attack surface, and apply compensating controls such as virtual patching, segmentation and privilege reduction before remediation is complete. This is especially important where the issue affects third-party components or applications that cannot be patched immediately.
👉 Read our full editorial: NVD backlog exposes the limits of traditional vulnerability management
