It means NIST has added the CVE record but does not plan to enrich it right away with its own severity score or affected product data. A scanner that depends only on NVD enrichment may therefore miss, mislabel or under-rank those CVEs. Teams should check which other sources their scanner uses.
What NVD announced
According to the NIST NVD page, from 15 April 2026 NIST prioritises enrichment of CVEs that are in CISA's Known Exploited Vulnerabilities catalog (with a goal of one business day), CVEs for software used within the federal government, and CVEs for critical software under Executive Order 14028. Other CVEs are still added, but labelled "Lowest Priority" and "not scheduled for immediate enrichment". Users can email NVD to request enrichment. NVD also no longer routinely provides its own severity score when the CNA already supplied one.
The same page reports that CVEs published before 1 March 2026 that were in the backlog were moved to "Not Scheduled".
Why scanners feel it
Enrichment is where NVD attaches the product and version ranges that scanners match against. A CVE without that data may exist in the feed but be hard to tie to a package version. Scanners that also use ecosystem advisories, vendor advisories or their own curation are less exposed. Scanners that read NVD alone are more exposed.
This matters for both models:
- With an open source scanner, you inherit whatever its maintainers chose as sources. Read the documentation and note which feeds it reads.
- With a managed platform, ask whether the vendor adds its own matching or curation, and how it handles a CVE that NVD has not enriched.
A short decision guide
| If your scanner relies on | Risk from the NVD change | What to do |
|---|---|---|
| NVD only | Higher | Add an ecosystem advisory source or switch tools |
| NVD plus ecosystem advisories | Moderate | Spot check lowest priority CVEs against package advisories |
| Multiple sources plus its own curation | Lower | Verify with the freshness test, quarterly |
Steps to take this week
- Find the data sources list in your scanner's documentation or ask the vendor in writing.
- Pull ten recent CVEs from your own dependency tree and check whether each appears in your scanner's output.
- For any miss, record the CVE, the package and whether NVD marks it lowest priority.
- Decide whether the gap is tolerable for your risk, or needs a second source.
- Add the KEV catalog as a separate check, because KEV entries are the ones NVD says it will enrich first and they signal confirmed exploitation.
Try it yourself
Click through it at your own pace, or open it full screen. Notice how each finding carries its source and status, which is what you want to be able to see in any tool.
Safeguard offers SBOM and dependency scanning with reachability analysis, and you can try a free scan at gold.safeguard.sh/scan.
Quick check
Does Lowest Priority mean the vulnerability is not dangerous?
No. It describes NVD's enrichment schedule, not the risk. Judge risk with exploitation evidence and your own exposure.
Can I ask NVD to enrich a specific CVE?
The NVD page says users can email NVD to request enrichment of lower priority CVEs. Check the page for the current process.
Sources
Last reviewed: 19 October 2026.
