On April 15, the National Institute of Standards and Technology (NIST) formalized a significant shift in how the National Vulnerability Database (NVD) operates. For years, security teams relied on the NVD as the authoritative secondary layer for Common Vulnerabilities and Exposures (CVEs). That assumption is now obsolete. NIST has explicitly stated it will not return to full-coverage enrichment for all entries. This decision impacts how container scanners, compliance programs, and DevOps pipelines prioritize vulnerabilities. If your security posture depends on the NVD sitting as the primary source of truth for scoring, you must restructure your workflows immediately.
Understanding the New Enrichment Model
The core of this change involves a triage system that categorizes CVEs based on urgency and government impact. Three specific categories will continue to receive full enrichment, including CVSS scores, CPE mappings, and CWE classifications. First, any CVE listed in CISA's Known Exploited Vulnerabilities catalog receives immediate attention, often within one business day. Second, vulnerabilities affecting software used within the federal government are prioritized. Third, issues impacting critical software as defined by Executive Order 14028 are treated with high priority. Everything else moves to a new "Not Scheduled" status. Organizations can request enrichment by emailing nvd@nist.gov, but there is no guaranteed service-level timeline for these requests. This shift means that for the vast majority of CVEs, you will no longer receive automatic scoring data.
Impact on Scanning and Compliance Workflows
Most container security platforms and compliance tools have built their logic around the expectation that the NVD provides consistent data. The decision to stop duplicating CVSS scores when a submitting CNA provides one further complicates this picture. Previously, if a vendor submitted a CVE with a score, the NVD would often duplicate it. Now, unenriched CVEs published before March 1, 2026, have been moved into the "Not Scheduled" bucket. This creates a gap in your visibility. If you are preparing for certifications like the Kubernetes certifications or working on cloud security architectures, you must understand that your scanners will face a higher volume of unscanned data. You cannot simply rely on the NVD feed to populate your dashboards. You will need to implement fallback mechanisms or rely more heavily on vendor-specific advisories. This architectural change requires a review of your SLA workflows. If your compliance program assumes a certain level of data availability, that assumption is now invalid.
Strategic Adjustments for Security Teams
The NIST volumes behind this decision cite a 263% increase in CVE submissions between 2022 and 2024. The sheer volume of submissions made it impossible to maintain the previous level of manual enrichment. For security teams, this means a shift from passive consumption to active management. You must evaluate whether your current tooling can handle a mix of enriched and unenriched data. For example, if a critical vulnerability is submitted without a score, your system must flag it based on the vendor advisory rather than waiting for NIST to assign a CVSS. This is a fundamental change in operational practice. Engineers studying for cloud security roles need to be comfortable with this ambiguity. The industry is moving toward a model where the NVD acts as a registry of existence rather than a registry of severity. This distinction is crucial for risk assessment. You must build your risk models to account for the possibility that a CVE has no score attached. This requires a deeper understanding of the underlying threat landscape and the ability to make decisions without perfect data.
What This Means For You
For DevOps professionals and AI engineers, this change necessitates a proactive approach to vulnerability management. You can no longer assume that a CVE published today will have a score tomorrow. Your pipelines must be designed to handle unenriched data gracefully. If you are managing containerized workloads, ensure your scanners have the capability to ingest raw CVE data and cross-reference it with external threat intelligence feeds. This reduces reliance on a single source. Furthermore, if you are involved in compliance audits, document your process for handling unenriched vulnerabilities. Auditors will expect to see how you mitigate risk when the NVD does not provide a score. This is a critical skill for any cloud engineer. The NVD Narrows the NVD availability of data, but your security program must remain robust regardless of the feed's limitations. Review your current scanning configurations and update your playbooks to reflect this new reality. The era of automatic, full-coverage enrichment is over, and your team must adapt to a more manual, high-touch verification process.