Topic starter
19/08/2026 3:41 pm
TL;DR: Publicly disclosed vulnerabilities can remain invisible to teams that depend only on the National Vulnerability Database, while attackers monitor the same disclosure channels for early exploitation, according to Intruder. The result is a shrinking remediation window that forces vulnerability management to treat disclosure streams, not NVD alone, as the operational source of truth.
Editorial analysis by NHI Mgmt Group, based on content published by Intruder: “Ghost CVEs: The Vulnerabilities You Don't Know About (Yet)”.
Key questions
Q: What breaks when teams rely on NVD as their only vulnerability signal?
A: They inherit a visibility delay that can leave exploitable issues untriaged for hours or days.
Q: Why does a disclosure-to-publication delay increase remediation risk?
A: Because attackers can read the same advisories, commits, and mailing lists that defenders use for awareness, then act before formal enrichment finishes.
Q: How do security teams know whether vulnerability assessment is actually working?
A: Teams should look for short triage cycles, high-confidence findings, and a clear link between scan results and remediation action.
Practitioner guidance
- Monitor disclosure channels before catalogue publication Track vendor advisories, Git commits, mailing lists, and trusted security feeds as first-class inputs to vulnerability response so new issues enter triage before NVD enrichment completes.
- Create a disclosure-first triage queue Route newly public vulnerabilities into a same-day review path that can assign owners, identify affected services, and decide whether patching, isolation, or compensating control is needed.
- Correlate new disclosures with asset context Link early advisory data to software inventory, exposed internet-facing services, and business criticality so teams can prioritise the systems most likely to be at risk.
Bottom line: Ghost CVEs are real vulnerabilities that exist before they are fully visible in the main catalogue many teams rely on.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:20 pm
Disclosure lag has become a governance problem, not just a data-quality problem. When security teams treat NVD as the operational truth, they are really outsourcing timing decisions to a downstream enrichment process. That is a fragile assumption in a threat environment where public disclosure and exploitation can happen in the same window. Practitioners should treat vulnerability intake as a governance function that starts at first public signal, not at catalogue publication.
A question worth separating out:
Q: What should teams do after a third-party access path may have exposed secrets?
A: They should map every credential the path could reach, determine where each one is used, and revoke or rotate it before updating dependent services. The goal is to close both the access route and the downstream replay risk before the same token is reused elsewhere.
👉 Read our full editorial: Ghost CVEs expose the vulnerability gap between disclosure and NVD