Topic starter
02/08/2026 11:57 am
TL;DR: NIST’s move to end enrichment for most open source vulnerabilities leaves nearly 300,000 backlogged CVEs in “Not Scheduled,” weakening the severity and version data that many SCA tools use for prioritisation, according to Semgrep. The shift makes reachability, KEV, and independently validated metadata central to defensible vulnerability management.
Editorial analysis by NHI Mgmt Group, based on content published by Semgrep: “NIST No Longer Enriching CVEs, Signaling Industry-Wide Shift Away from NVD.”.
Key questions
Q: What breaks when NVD enrichment is no longer available for most CVEs?
A: SCA tools lose the normalised metadata that helps them decide what is affected, how severe it is and whether it should move first.
Q: Why should teams use reachability instead of raw CVSS alone?
A: Raw CVSS measures theoretical severity, not whether the vulnerable code can actually be invoked in your application.
Q: What do security teams get wrong about vulnerability prioritisation?
A: Security teams often treat vulnerability scores as if they represent operational risk on their own.
Practitioner guidance
- Update compliance wording and evidence sources Review FedRAMP packages, PCI DSS evidence, customer questionnaires and cyber insurance forms to remove any statement that NVD CVSS is the sole source of truth for prioritisation.
- Shift prioritisation to contextual signals Make KEV, EPSS and reachability the baseline decision stack, then document when a raw CVSS score is only a supporting input rather than the trigger for remediation.
- Challenge SCA vendors on data provenance Ask whether severity comes from CNA assignment, independent calculation or another source, and ask how deep their reachability analysis goes, from dependency level through function and dataflow.
Bottom line: The article shows that prioritisation built on a single enriched vulnerability feed is becoming less reliable as backlog and disclosure volume grow.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:05 pm
CVE prioritisation is moving from catalogue-driven to context-driven. The article shows why a long-standing assumption in vulnerability management is breaking down: that centralised severity data is enough to rank remediation. Once enrichment lags, organisations have to rely on reachability, exploit intelligence and local asset context to make defensible decisions. That is a governance change, not just a tooling change. Security teams should stop treating severity as a stable proxy for risk.
A question worth separating out:
Q: How should teams respond when their vulnerability data source changes?
A: They should revalidate compliance language, reassess scoring assumptions and confirm how their tooling sources severity, version data and advisory metadata. The right response is to test whether the new dataset still supports the decisions the programme needs to make, not to assume the old prioritisation logic still holds.
👉 Read our full editorial: NVD enrichment changes expose the limits of CVE prioritization