NIST Vulnerability Database Faces Underinvestment Amidst Rising Cyber Threats

The National Institute of Standards and Technology (NIST) has announced a change in how it manages the National Vulnerability Database (NVD), which is critical for cybersecurity defense. NIST will focus on enriching a narrower set of vulnerabilities, specifically those listed in the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog, those impacting federal software, and critical software as defined by Executive Order 14028.

This shift comes as CVE submissions surged by 263% from 2020 to 2025, overwhelming the current capacity of just 21 analysts at NIST. The expected influx of new vulnerabilities, projected to exceed 70,000 in 2026, further complicates the situation.

Policymakers are cautioned against treating this scarcity-driven adjustment as an optimal solution, as it risks creating a fragmented vulnerability management system and eroding public trust in the NVD's reliability. A significant funding increase is required to restore and maintain the NVD as a crucial public good.