CVE Programme and NVD Backlog Guide

Most vulnerability tools assume that every CVE arrives with a severity score, a weakness type and a machine-readable list of affected products, and since 2024 that assumption has been false for a large share of new CVEs. The US National Vulnerability Database (NVD) built a backlog of unenriched records from early 2024, and in April 2026 NIST formally moved to enriching only a prioritised subset. In the same period the CVE Programme itself came within a day of losing its funding. This guide explains how the CVE Programme and the NVD fit together, what changed between 2024 and October 2026, which other sources now fill the gaps (CNA data, CISA Vulnrichment, the ENISA European Vulnerability Database, GCVE), and how to change a vulnerability management pipeline so that it does not depend on one enrichment source. It is for vulnerability management, threat intelligence and tooling teams. For the overall programme see the Vulnerability Management Guide.

Key takeaways

CVE and NVD are different things: the CVE Programme assigns identifiers and publishes records written by CVE Numbering Authorities; the NVD, run by NIST, adds enrichment such as CPE applicability, CWE and its own CVSS scores on top.
The NVD now enriches selectively: since 15 April 2026 it prioritises CVEs in the CISA KEV catalog (goal: within one business day), federal-use and critical software, and labels the rest "Lowest Priority - not scheduled for immediate enrichment".
The CNA record is now the primary source: CVE Record Format 5.x lets CNAs supply affected versions, CWE, CVSS and CPE applicability directly, and many do. Read it rather than waiting for the NVD.
Funding was resolved, governance was not settled: the MITRE contract was extended for 11 months in April 2025 and CISA said in March 2026 that the programme was fully funded under its sponsorship, but contract terms remain largely undisclosed.
Build for several sources: CISA Vulnrichment, vendor advisories, the EUVD and GCVE reduce single-source risk; your pipeline should record which source supplied each field.

How the CVE Programme works

A CVE identifier (CVE-YYYY-NNNN, with four or more digits after the year) names one vulnerability so that vendors, scanners and defenders talk about the same thing. The programme is federated: no single organisation analyses every flaw.

Role	Who	What it does
CVE Numbering Authority (CNA)	Vendors, open-source projects, CERTs, bug bounty platforms and researchers. CISA's 2025 strategy describes more than 460 CNAs	Assigns CVE IDs within its scope and writes the CVE record: description, affected products and versions, references, and optionally CWE, CVSS and CPE
Root and Top-Level Root	Organisations that recruit and oversee CNAs in a domain or region	Onboarding, scope disputes, quality oversight
CNA of Last Resort	Assigns when no other CNA has scope	Coverage for products with no vendor CNA
Authorized Data Publisher (ADP)	Organisations allowed to add data to records they did not write, such as CISA	Publishes an ADP container alongside the CNA's data, without overwriting it
Secretariat and Board	MITRE operates the programme under CISA sponsorship; the CVE Board advises	Programme operations, rules, CVE Services infrastructure and cve.org

The CVE Record Format is a JSON schema maintained in the CVEProject/cve-schema repository. Points that matter for tooling:

Version: the dataVersion field accepts any 5.x value; the current schema default is 5.2.0. Parsers written for the old 4.0 JSON feeds will miss fields.
States: a record is either PUBLISHED or REJECTED. Rejected IDs must be removed from findings, not left open.
Containers: the cna container is required and must carry providerMetadata, descriptions, affected and references. Zero or more adp containers carry third-party enrichment.
Affected products: each entry names a vendor and product (or a package collection URL and package name) plus versions or a default status, which lets a pipeline match versions without CPE.
Optional enrichment fields: problemTypes with a cweId, metrics for CVSS v4.0, v3.1, v3.0 or v2.0, and cpeApplicability for CPE match criteria. When a CNA fills these, NVD enrichment adds little.

Full CVE records are published in the CVEProject cvelistV5 repository on GitHub and through the CVE Services API, which is how most tools consume them.

The April 2025 funding episode and where governance stands

15 April 2025: a letter from MITRE warned that its contract to run the CVE Programme would expire the next day and that the government appeared unlikely to renew. MITRE said that a lapse would stop new CVEs being added, although historical records would remain available on GitHub.
Same evening: CISA exercised the option period on the contract, which The Record reported as worth USD 57.8 million, extending it by 11 months to 16 March 2026.
CVE Foundation: before the extension was announced, several CVE Board members said they were forming a non-profit CVE Foundation, arguing that dependence on a single government sponsor threatened the programme's sustainability and neutrality.
10 September 2025: CISA published "CVE Quality for a Cyber Secure Future", describing a shift from a growth era to a "quality era", calling for the programme to stay publicly maintained and vendor-neutral, rejecting privatisation, and committing CISA to a more active leadership role, automation, minimum record-quality standards and federated enrichment.
March 2026: CSO, reporting before the March deadline, said the contract had been renegotiated and that CVE had reportedly moved from a discretionary to a protected line in CISA's budget. Acting CISA Director Nick Andersen said the programme was "fully funded" under CISA sponsorship. The contract terms and amount were largely undisclosed, MITRE retained final decision-making authority with the board advisory, and the CVE Foundation said it was reassessing its next steps.

As of October 2026 we have not found a primary source describing any later change of operator. Treat the programme as operating under CISA sponsorship with MITRE as operator, and keep a contingency plan for identifier assignment and record retrieval in case that changes.

The NVD enrichment backlog, 2024 to 2026

NVD enrichment means NIST analysts adding CPE applicability statements (which products and versions are affected, in CPE 2.3 form), CWE mappings and NVD CVSS scores. Many scanners and vulnerability platforms matched assets to CVEs only through NVD CPE data, so a CVE without enrichment could be invisible to them. The backlog began in early 2024.

Date	NVD status update	Practical effect
19 March 2025	Processing back to roughly the pre-slowdown rate, but submissions rose 32 per cent in 2024 and "the backlog is still growing"; exploring machine learning	Enrichment gaps persisted for new CVEs
2 April 2025	CVEs published before 2018 and still awaiting enrichment marked "Deferred"; KEV CVEs still prioritised	Older CVEs would not be enriched on age grounds
24 July 2025	KEV date-range filters added to the NVD CVE API	Easier to pull exploited CVEs directly
15 April 2026	Risk-based model: KEV CVEs first (goal within one business day of receipt), then federal-use and critical software; others "Lowest Priority - not scheduled for immediate enrichment"; CVEs published before 1 March 2026 moved to "Not Scheduled"; NVD stops routinely adding its own severity score where the CNA has provided one; modified CVEs re-analysed only when changes materially affect enrichment; previously Deferred CVEs moved to "Modified After Enrichment"	Most CVEs will carry only CNA and ADP data in the NVD
28 April 2026	About 4,500 records had inflated CVSS v4.0 numerical scores; corrected by script, with automated verification to follow	Recheck v4.0 scores imported before the fix
May to August 2026	NVD displays SSVC data from the CISA ADP alongside CVSS	SSVC decision points visible in NVD records

NIST gave the cause in its April 2026 update: CVE submissions grew 263 per cent between 2020 and 2025, and although it enriched nearly 42,000 CVEs in 2025, that was not enough to keep pace. The model is a permanent change in what the NVD does, not a temporary delay.

Where enrichment comes from now

Source	What it adds	Strengths	Watch for
CNA record (CVE Record Format 5.x)	Affected versions, CWE, CVSS, CPE applicability where supplied	Written by the party closest to the product; available at publication	Quality varies by CNA; some supply only a description and references
CISA Vulnrichment (ADP container)	SSVC decision points (Exploitation, Automatable, Technical Impact) using the CISA Coordinator tree; CWE and CVSS for high-risk CVEs; a KEV block	Arrives inside the CVE record; never overwrites CNA data, and CISA removes its own entries if the CNA later supplies them	Stopped adding CPE strings on 10 December 2024
NVD	CPE applicability, CWE, links to KEV, display of CNA and ADP scores	Long-standing API used by most tools	Selective enrichment from April 2026; no routine NVD severity score where the CNA has provided one
Vendor security advisories	Fixed versions, workarounds, exploitation status	Most precise for remediation	Each vendor uses its own format and channel
ENISA European Vulnerability Database (EUVD)	Aggregated vulnerability records with views for critical, exploited and EU CSIRT-coordinated vulnerabilities	Operational since 13 May 2025 under the NIS2 Directive; CVE data imported automatically; ENISA has been a CNA since January 2024	Complements rather than replaces CVE; check its API terms before automating
GCVE (Global CVE allocation system)	Decentralised identifiers issued by GCVE Numbering Authorities (GNAs), with CVE listed as GNA 0 and CIRCL as GNA 1	Records follow the CVE Record Format; GNAs publish through an API or NDJSON dumps; db.gcve.eu lookup service	Identifiers outside CVE will not match tools that only key on CVE IDs

CISA's Known Exploited Vulnerabilities catalog remains the most important prioritisation input and is independent of NVD enrichment. See the Zero-Day and Exploited Vulnerabilities Guide for how to combine KEV, EPSS, SSVC and CVSS.

Coping with enrichment gaps: an implementation plan

Measure your exposure first: for the last 90 days of CVEs relevant to your estate, count how many your scanner or platform matched, and how many had no NVD CPE data. This tells you how much of your detection depends on NVD enrichment. Ask each tool vendor in writing which sources they use when NVD data is absent.
Ingest CVE records directly: consume cvelistV5 or the CVE Services API and parse the cna and all adp containers. Store the source of every field (CNA, CISA ADP, NVD, vendor) so analysts can see where a score came from.
Match on the affected block, not only CPE: use vendor, product and version ranges from the CNA record, and package ecosystem identifiers (package URL style) for open-source components. Link this to your SBOMs. See the SBOM Guide.
Set a scoring precedence rule: for example vendor or CNA CVSS first, then CISA ADP, then NVD, and record it in the vulnerability management policy so that teams do not argue about which number counts. Use SSVC and KEV for urgency rather than CVSS alone.
Close the vendor gap: subscribe to advisories from your top 20 software suppliers by asset count, and to their CSAF or machine-readable feeds where offered. Many critical fixes appear in vendor advisories before any database is enriched.
Handle unscored CVEs explicitly: create a queue for CVEs affecting your products with no score from any source, and triage them by product exposure and exploitation signals instead of ignoring them.
Test and roll back: run the new matching logic in parallel with the old for one or two months, compare findings, and keep the old feed available as a fallback until the difference is understood.
Plan for identifier disruption: document how you would track vulnerabilities if new CVE IDs stopped: vendor advisory IDs, EUVD or GCVE identifiers, and internal IDs mapped later to CVE.

Decision guidance by organisation size

Small teams relying on one commercial scanner: you cannot build a multi-source pipeline. Ask the vendor how it handles unenriched CVEs, add the KEV catalog and your top vendors' advisories to a weekly review, and treat "no score" as "not yet assessed", never "low".
Mid-sized organisations: ingest CVE records with ADP data into the existing platform or a lightweight database, and set the scoring precedence rule in policy.
Large enterprises and software vendors: run your own enrichment for products you depend on, consider becoming a CNA for your own products so your records are complete at publication, and contribute corrections to CNAs. See the Bug Bounty and Vulnerability Disclosure Guide.
EU-regulated entities: add the EUVD to the source list, because NIS2-era coordination by European CSIRTs will surface there.

Detection and measurement

Monitor the health of the vulnerability data pipeline itself, not just the vulnerabilities in it.

Enrichment coverage: percentage of CVEs affecting your products that have a usable score and affected-version data from any source within 7 days of publication.
Single-source dependency: share of findings whose only matching data came from NVD CPE.
Unscored queue age: median days a relevant CVE sits with no score from any source.
KEV latency: hours from a KEV addition to a finding or ticket in your system.
Rejected record hygiene: count of open findings tied to CVEs in the REJECTED state (target: zero).
Feed freshness: alert when the CVE, KEV or vendor advisory ingestion has not updated for more than 24 hours.

Framework mapping

Framework	Reference	How it applies
NIST CSF 2.0	ID.RA-01; ID.RA-02; ID.RA-08	Identify and record vulnerabilities; receive threat intelligence from information sharing sources; process vulnerability disclosures
NIST SP 800-53 Rev. 5	RA-5 Vulnerability Monitoring and Scanning; RA-5(2) Update Vulnerabilities to Be Scanned	Keep the vulnerability data feeding scanners current and complete
NIST SP 800-53 Rev. 5	SI-5 Security Alerts, Advisories, and Directives; SI-2 Flaw Remediation	Ingest advisories and KEV; remediate within defined timeframes
NIST SP 800-53 Rev. 5 and CSF 2.0	CM-8 System Component Inventory; ID.AM-02	Software inventory precise enough to match CNA affected-version data
ISO/IEC 27001:2022 Annex A	A.5.7 Threat intelligence; A.8.8 Management of technical vulnerabilities	Information about vulnerabilities obtained from appropriate sources and evaluated
CIS Controls v8.1	Control 7, Safeguard 7.1	A documented vulnerability management process that names its data sources

Common failure patterns

Treating "no NVD score" as "not important": dashboards that sort by NVD CVSS push unenriched CVEs to the bottom, even when the CNA or CISA ADP has rated them critical.
CPE-only matching: scanners that never see a CVE because no CPE statement exists, so the asset reports clean. The Vulnerability Management Guide covers CPE matching limits.
Stale parsers: pipelines still built on retired NVD 1.1 JSON feeds or CVE JSON 4.0 that silently drop CVSS v4.0 and ADP data.
Mixing scores without provenance: a CNA CVSS v3.1 score, an ADP v3.1 score and an NVD v4.0 score for the same CVE, with nobody knowing which drove the SLA.
Single-source contingency gap: in April 2025 many organisations discovered on the day that they had no plan for a CVE outage.
Ignoring rejected and modified records: findings stay open against rejected IDs, or a later change to affected versions is never picked up.

Practitioner checklist

Inventory every tool that consumes vulnerability data and record which sources each uses when NVD enrichment is missing.
Ingest CVE records in Record Format 5.x, including all ADP containers.
Match on CNA affected-version data and package identifiers as well as CPE.
Publish a scoring precedence rule and store the source of every score.
Pull CISA KEV daily and Vulnrichment SSVC data into prioritisation.
Subscribe to machine-readable advisories from your top software suppliers.
Add the EUVD where EU coordination matters, and track GCVE identifiers if your suppliers use them.
Run a weekly review of relevant CVEs with no score from any source.
Write a contingency procedure for a CVE assignment or NVD outage, and test it once a year.

CVE Programme and NVD Backlog Guide: How CVEs Work and Coping with Enrichment Gaps