NIST Revamps CVE Framework to Focus on High-Impact Vulnerabilities

NIST is altering its CVE handling process amid a large backlog and a surge in vulnerability submissions: starting April 15 the agency will fully enrich only a prioritized subset of CVEs (those in the CISA KEV catalog, federal software, and EO‑14028 critical software) while marking others as "Not Scheduled." The shift toward risk-based prioritization — emphasizing real-world exploitability and curated actionable data — is intended to focus limited resources but will require organizations to rely more on KEV/exploitability signals and distributed threat intelligence rather than a single comprehensive government database.