NVD has moved to risk-based enrichment. CVEs in the CISA KEV catalog come first, with a goal of one business day. Many others are listed but labelled "Lowest Priority" or "Not Scheduled", meaning NVD has not queued them for its own analysis. The CVE record itself still exists and can carry data from its CNA.
What NIST announced
On its NVD program page, NIST describes a change dated 15 April 2026. It cites a 263% rise in CVE submissions between 2020 and 2025 and says NVD will prioritize three groups: CVEs in CISA's KEV catalog, software used by the federal government, and critical software as defined under EO 14028.
Everything else stays in the database. Those records are labelled "Lowest Priority, not scheduled for immediate enrichment", and anyone can email NVD to ask for a specific CVE to be enriched.
The same announcement moved backlogged CVEs published before 1 March 2026 to "Not Scheduled", except KEV entries. Earlier, on 2 April 2025, pre-2018 CVEs that were still awaiting enrichment had been marked "Deferred". On 15 April 2026 those deferred records were moved to "Modified After Enrichment".
What "enrichment" means in practice
Enrichment is the work NVD adds on top of the raw CVE record: its own severity score, weakness type, and the product match data (CPE) that many scanners use to decide whether a version is affected. A CVE with no NVD enrichment can still have all of that from its CNA, or from other data publishers. It can also have none of it.
NVD also said it will no longer routinely create its own severity score when a CNA has already provided one. Users can email NVD to request a separate score for particular CVEs.
What changes in your tooling
| If your scanner relies on | Risk with unenriched CVEs | What to check |
|---|---|---|
| NVD severity only | No score shows up, finding sorts as unrated | Fall back to the CNA score, show its source |
| NVD CPE matches only | Product match missing, finding never triggers | Confirm it also reads ecosystem advisories |
| Both NVD and package advisories | Usually covered | Confirm which source wins on conflict |
Steps to take this week:
- List which fields your scanner reads from NVD and which from other sources.
- Pull ten recent CVEs for libraries you use and note which ones lack an NVD score.
- Decide a rule for unrated findings in your gate, for example "use the CNA score, and treat KEV as urgent regardless".
- Record the rule so an auditor can see how unrated items are handled.
What it does not mean
It does not mean the vulnerability is minor. The label describes NVD's own workload, not the risk. A "Not Scheduled" CVE in a library you ship can be serious. Equally, a missing NVD score is not a clean result. Our post on what a clean scan does and does not tell you covers the same trap from the scanner side.
Where Safeguard fits
Safeguard provides SBOM and dependency scanning, reachability analysis, and policies that can gate on KEV status. You can run a free scan at gold.safeguard.sh/scan and compare any finding against the public sources listed below.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how findings are ordered when a severity score is missing.
Quick check
Does Not Scheduled mean a CVE is not real?
No. The CVE record stays published. The label only says NVD has not queued it for its own enrichment work.
Which CVEs does NVD enrich first?
Per the 15 April 2026 announcement, KEV catalog entries, federal-use software and critical software under EO 14028. KEV entries have a goal of one business day.
Can I ask NVD to enrich a specific CVE?
NIST says users can email NVD to request enrichment of a Lowest Priority CVE, or to request a separate score where a CNA already provided one.
Sources
- NIST, NVD program page and announcements, fetched 19 October 2026.
Last reviewed: 19 October 2026.
