NIST Enrichment Reductions Impact CVE Coverage, Accuracy

Volerion's analysis of NVD data from April 15–June 15 finds that NIST's recent cutbacks to CVE enrichment left many accepted CVEs unanalyzed or delayed, reduced the number of NIST-produced CVSS vectors, and produced score and vector inconsistencies compared with CNAs and vendor assessments; the report highlights operational impacts for vulnerability prioritization (including FedRAMP reliance), provides examples of significant scoring disagreements, and recommends organizations adopt richer contextual prioritization and alternative enrichment sources.