GoKawiilNIST's NVD Backlog Fix Leaves 30,000 CVEs Unscored, Raising Enterprise Risk
NIST has responded to a surge in vulnerability disclosures by reclassifying about 30,000 CVEs published before March 2026 as 'Not Scheduled,' effectively deprioritizing their enrichment. The move comes as Action1's 2026 report shows disclosed vulnerabilities in enterprise software jumped 92% in 2025, with critical and high-severity flaws each up 103% and remote-code-execution bugs up 128%.
GoKawiil's interpretation of the reporting above, not reported fact.
When older vulnerabilities go unenriched, security teams lose the context needed to judge real-world risk, even if those flaws are already known or exploited. This risks creating blind spots in enterprise patch prioritization just as AI-accelerated vulnerability discovery is pushing disclosure volumes far beyond what manual review pipelines were built to handle.
- NIST reclassified ~30,000 pre-2026 CVEs as 'Not Scheduled' due to enrichment backlog.
- Enterprise vulnerability disclosures rose 92% in 2025, with RCE flaws up 128%.
- Deprioritizing older CVEs risks leaving known or exploited vulnerabilities without full context for defenders.
Practical Vulnerability Management (No Starch Press) — With CVE volume exploding and enrichment pipelines falling behind, defenders need a repeatable process rather than a feed to lean on. Andrew Magnusson's Practical Vulnerability Management walks through building your own scanning, prioritization and remediation workflow from the ground up — exactly the muscle this article says teams must develop in-house.
See Practical Vulnerability Management (No Starch Press) on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-08-28
Published there as: “AI Is Accelerating Vulnerability Discovery. Can Defenders Keep Up?”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.