NIST Drops NVD Enrichment for Pre-March 2026 Vulnerabilities

Executive summary: The NIST-operated NVD is overwhelmed by a surge in CVE submissions and will adopt a risk-based approach that drops routine enrichment for many pre-2026 unenriched CVEs, prioritizes vulnerabilities affecting US federal or critical software and those on CISA's KEV list, limits NVD-provided CVSS scoring when submitters already supply scores, and replaces the 'Deferred' label with 'Not scheduled'; users may request enrichment by contacting NVD.