Skip to content
T threat.cafe

· Tobias Lindqvist-Rao (editorial persona) · Intel commons after NVD · on threat.cafe

After NVD's triage: what a 2026 CVE record still carries, and how small teams rebuild triage for free

Since 15 April 2026, NIST fully enriches only CVEs that are in CISA's KEV catalog, affect software the US federal government uses, or count as "critical software" under Executive Order 14028. Everything else is labelled lowest priority and waits. The breakage small teams see is mostly not missing severity. In a threat.cafe sample of 890 CVE records published between January and September 2026, 96.0% carried a CVSS score from the CNA or CISA's enrichment container. Only 9.6% carried a CPE string. Scanners that match products through NVD's CPE configurations lose their matches. The fix is to match on packages and vendor advisories, and to triage on KEV, CISA's SSVC decision points and EPSS.

The symptom

The alert looks like a data-quality bug. A scanner or SIEM enrichment rule shows new CVEs with no NVD severity, a status of "Lowest Priority - not scheduled for immediate enrichment", or no affected-product match at all. Older backlog CVEs carry "Not Scheduled".

The cause is documented. NIST's 15 April 2026 announcement sets the three priority criteria, moves backlogged CVEs with an NVD publish date before 1 March 2026 into "Not Scheduled", and says NIST will "no longer routinely provide a separate severity score" when the CNA has already scored a CVE. NIST cites a 263% rise in CVE submissions between 2020 and 2025, even after enriching nearly 42,000 CVEs in 2025.

The Cloud Security Alliance's research note of 29 April 2026 estimates that the three priority categories cover 15 to 20% of projected annual volume, and that about 29,000 backlogged CVEs moved to "Not Scheduled". Those are CSA estimates, not NIST figures. Trend Micro's July 2026 analysis, citing Zafran, says the NVD fully analysed about 28% of newly disclosed 2025 CVEs, so the gap predates the policy.

Topology: where your tools read the fields

A CVE has two layers of data. The CVE record, published by the CVE Program, holds a cna container written by the CVE Numbering Authority and optional adp containers written by Authorised Data Publishers such as CISA. The NVD then adds NIST's own CVSS, CWE and, most importantly, CPE match configurations.

Most small-team tooling reads the NVD layer only. A scanner asks, "which CPE match configurations cover the product strings on this host?" If NIST never wrote a configuration, the answer is nothing. The CVE did not go away. The join key did.

Telemetry: what the CVE record carries without NIST

The threat.cafe editors sampled 1,500 random IDs between CVE-2026-1 and CVE-2026-110999 from the CVE List V5 repository on 15 October 2026. Of those, 1,008 existed; 994 were published and 14 rejected. 890 were published between 1 January and 30 September 2026.

Field in the CVE record (n = 890)            Records   Share
CNA CVSS score (any version)                      728   81.8%
Any CVSS (CNA or an ADP container)                854   96.0%
CNA CWE                                           692   77.8%
Any CWE (CNA or CISA-ADP)                         809   90.9%
CNA affected versions                             884   99.3%
CNA CPE strings                                    85    9.6%
CNA package URL (PURL)                             59    6.6%
CISA-ADP container present                        813   91.3%
CISA-ADP SSVC decision points                     813   91.3%
CISA-ADP CVSS added                               133   14.9%
CISA-ADP CPE added                                  0    0.0%
GitHub (GHSA) as assigning CNA                    164   18.4%

Two limits apply. Random ID sampling over-represents CNAs that reserve large ID blocks, so treat the shares as indicative, not census values. And the sample measures the CVE record, not the NVD record. The proxy blocked the NVD API from our workspace, so this article does not measure NVD status directly.

Three hypotheses that were wrong

"Severity is gone." Not in this sample. CNAs scored 81.8% of records themselves, and CISA's ADP filled more. What changed is whose score you get. A CNA is often the vendor of the affected product, so its CVSS is the vendor's own claim.

"CISA will fill the CPE gap." It will not. CISA's Vulnrichment README states that "as of December 10, 2024, CISA will no longer be adding CPE strings to the enriched dataset." The sample agrees: zero CISA-ADP CPEs.

"Switch to a commercial NVD mirror and the problem ends." A mirror that re-publishes NVD fields inherits NVD's gaps. Only a source that does its own product mapping changes the match rate. Ask any vendor for its match coverage on 2026 CVEs before paying for it.

Root cause: the join key, not the score

Product matching is the broken layer. Only 85 of 890 records carried a CPE from the CNA, and 59 carried a PURL. Nearly every record listed affected versions (99.3%), but against free-text vendor and product names. A machine cannot join "FortiOS" in a CVE record to "Fortinet FortiGate 60F" in an asset list without someone writing the mapping. NIST used to write it. For roughly four in five new CVEs, by CSA's estimate, nobody now does.

The fix: a field-by-field substitute map

NVD field you lost     Free substitute                         Coverage here   Caveat
NIST CVSS              CNA CVSS, then CISA-ADP CVSS            96.0% any       Vendor-scored; read the vector
NIST CWE               CNA problemTypes, then CISA-ADP          90.9% any       Useful for trends, not triage
CPE configurations     OSV / GitHub Advisory DB (packages)      n/a             Open-source packages only
                       Vendor advisories + your product map     n/a             You maintain the map
Exploitation signal    CISA KEV                                 n/a             NIST aims to enrich KEV in 1 day
                       CISA-ADP SSVC "Exploitation"             91.3%           Snapshot at analysis time
                       FIRST EPSS (daily probability)           n/a             Probability, not proof

For open-source dependencies, match by package, not CPE. OSV and the GitHub Advisory Database key advisories to ecosystem and package name, which is also how lockfiles and SBOMs describe software. For appliances and commercial products, keep a small hand-written map from your asset strings to vendor product names and subscribe to those vendors' advisories. That map is maybe forty lines for a small estate.

For triage, CISA's SSVC points are already in 91.3% of the sample. In those 813 records, CISA marked exploitation "active" on 4 and "poc" on 194. Only 16 combined proof-of-concept or active exploitation with "Automatable: yes" and "Technical Impact: total". Add KEV and an EPSS threshold, and the review queue for a month of new CVEs is short.

#!/usr/bin/env python3
"""Print triage fields from one CVE JSON 5.x record (cvelistV5 format)."""
import json
import sys

def triage(path):
    try:
        with open(path, encoding="utf-8") as fh:
            rec = json.load(fh)
    except (OSError, json.JSONDecodeError) as err:
        sys.exit(f"cannot read {path}: {err}")
    cna = rec.get("containers", {}).get("cna", {})
    out = {"id": rec.get("cveMetadata", {}).get("cveId"), "cvss": None,
           "cwe": [], "purls": [], "cpes": [], "ssvc": {}}
    for m in cna.get("metrics", []):
        for key in ("cvssV4_0", "cvssV3_1", "cvssV3_0"):
            if key in m and out["cvss"] is None:
                out["cvss"] = (key, m[key].get("baseScore"), "cna")
    for pt in cna.get("problemTypes", []):
        out["cwe"] += [d["cweId"] for d in pt.get("descriptions", []) if d.get("cweId")]
    for a in cna.get("affected", []):
        if a.get("packageURL"):
            out["purls"].append(a["packageURL"])
        out["cpes"] += a.get("cpes", [])
    for adp in rec.get("containers", {}).get("adp", []):
        if adp.get("providerMetadata", {}).get("shortName") != "CISA-ADP":
            continue
        for m in adp.get("metrics", []):
            other = m.get("other", {})
            if other.get("type") == "ssvc":
                for opt in other.get("content", {}).get("options", []):
                    out["ssvc"].update(opt)
            for key in ("cvssV4_0", "cvssV3_1", "cvssV3_0"):
                if key in m and out["cvss"] is None:
                    out["cvss"] = (key, m[key].get("baseScore"), "cisa-adp")
    return out

if __name__ == "__main__":
    if len(sys.argv) != 2:
        sys.exit("usage: triage.py CVE-YYYY-NNNN.json")
    print(json.dumps(triage(sys.argv[1]), indent=2))

Run it against a file from the cvelistV5 repository. A record with an empty purls and cpes list is one your scanner cannot match automatically.

Trade-offs and residual risk

You now trust CNAs. Vendor-assigned scores can understate their own bugs, and nobody at NIST is second-scoring most of them. Read the CVSS vector, not just the number.

You also own a product map. It drifts when you buy new kit. Put it in version control next to the asset inventory and review it quarterly.

And the policy may change again. NIST says lowest-priority CVEs will be enriched "as resources allow", and anyone can request enrichment of a specific CVE by email to the NVD team. Re-run the sample each quarter before trusting these shares.

Reproduction notes

Sample drawn on 15 October 2026 with a fixed random seed from CVE-2026-1 to CVE-2026-110999, files fetched from the main branch of CVEProject/cvelistV5. Window: datePublished from 2026-01-01 to 2026-09-30. A CVSS counts if any cvssV2_0, cvssV3_0, cvssV3_1 or cvssV4_0 object is present. NVD-side status was not measured.

The same package-first logic is how the threat.cafe list identifies malicious agent packages and skills, in OSV format, without waiting for a CVE.

Sources

#nvd #cve #cisa-vulnrichment #osv #epss

All posts