A scanner reports a CVE published yesterday. The NVD entry exists, but the CVSS field is empty, with no CPE and no CWE. The queue sorts by score, so the finding drops to the bottom. Nobody decided that; the sort did.
This used to be a transient. It is now the normal state for many new CVEs, and a workflow that assumes a score will appear within a day or two is working from an outdated picture of NVD.
What NIST changed in 2026
On April 15, 2026, NIST published “NIST Updates NVD Operations to Address Record CVE Growth.” The announcement states the driver plainly: “This change is driven by a surge in CVE submissions, which increased 263% between 2020 and 2025.” It adds that “Submissions during the first three months of 2026 are nearly one-third higher than the same period last year.”
In the past the program “aimed to analyze all CVEs.” Now, “Starting on April 15, 2026, we will prioritize the following CVEs for enrichment”: CVEs in CISA’s Known Exploited Vulnerabilities catalog, with a goal “to enrich these within one business day of receipt”; “CVEs for software used within the federal government”; and “CVEs for critical software as defined by Executive Order 14028.” Everything else “will be categorized as ‘Lowest Priority - not scheduled for immediate enrichment.’”
Two further changes matter for consumers. NIST “will no longer routinely provide a separate severity score” where the submitting CVE Numbering Authority already supplied one. And the backlog was not cleared: “Starting in early 2024, the NVD developed a significant backlog of unenriched CVEs”; those with an NVD publish date before March 1, 2026 moved into a “Not Scheduled” category.
For a CVE outside those groups, NIST enrichment may remain unscheduled; the absence of a NIST score does not establish whether another source has scored it.
The 2024 backlog as background
NIST’s NVD program page carries the status history. The March 19, 2025 update reported a “processing slowdown in spring and early summer of 2024” and that “CVE submissions increased 32 percent in 2024, and that prior processing rate is no longer sufficient to keep up with incoming submissions. As a result, the backlog is still growing.”
On April 2, 2025 (clarified April 10), NIST introduced a “Deferred” status: “All CVEs with a published date prior to 01/01/2018 that are awaiting further enrichment will be marked as Deferred within the NVD dataset,” indicating “that we do not plan to prioritize updating their enrichment data due to the CVE’s age.” The 2026 announcement moves those CVEs to “Modified After Enrichment.” Labels have changed twice in eighteen months; display the status field rather than mapping it to a severity.
Where a score may already exist
An empty NVD field does not mean nobody scored the vulnerability. Check the originating CNA assessment and any CISA ADP enrichment, retaining attribution for each value.
The second source is CISA’s Vulnrichment program, which its README describes as “the public repository of CISA’s enrichment of public CVE records through CISA’s ADP (Authorized Data Publisher) container.” CISA “is assessing new and recent CVEs and adding key SSVC decision points,” and “some higher-risk CVEs will also receive enrichment of CWE and/or CVSS data points, where possible.” These values sit in the ADP container beside the CNA’s data: “At no point will CISA overwrite the originating CNA’s data in the original CNA container.” None of them depend on NVD’s queue.
Record where each value came from; “CVSS 8.1” without saying whose is less useful than the same number attributed.
Triage without a score
Suppose a CVE in a message-queue library arrives with a CNA description, no CVSS anywhere, no CPE, and a “not scheduled” NVD status. The remaining questions were always the real work.
Is the affected component present? The description names the product and version range; inventory and the scanner’s package data say whether that version is installed anywhere. If not, the finding closes on evidence, and the missing score never mattered.
Is it reachable? A library loaded by an internet-facing service and the same library in a build container differ in exposure. Reachability is an observation the operator supplies.
What does the vendor advisory say? Many CNAs are vendors, and their advisory usually states severity and, more usefully, preconditions: authentication required, a non-default option, a specific deployment mode. Read the description for conditions, not adjectives.
Is it on CISA KEV? The catalog requires “reliable evidence that the vulnerability has been actively exploited in the wild.” Under the 2026 criteria a KEV entry also triggers NIST’s one-business-day enrichment goal.
What is the EPSS value? FIRST’s How It Works page states that for a newly disclosed vulnerability “EPSS still produces a score from that sparse record,” and that the model “handles missing values naturally without requiring gap-filling.” EPSS does not wait for NVD. Treat a day-one value with caution, since it moves as signal accumulates, and record the score date.
Representing unscored in the queue
The failure mode is quiet: a sort treats null as zero, a dashboard renders an empty field as “Low,” and an unknown becomes a decision nobody made. The sibling article on not fabricating data covers the general rule.
Where no applicable CVSS score is available, label the score unavailable and record enrichment status separately; retain any attributed severity assessment or provisional local judgment. Show that as its own value, distinct from any severity band, and keep it out of the sorted tail. A finding present on a reachable host with a plausible precondition is not low because a field is empty.
Write the enrichment status next to the finding: NVD status as published, whether a CNA or ADP score exists, and the date last checked.
When to re-check
A CVE may gain a CNA score at publication, a CISA ADP assessment days later, and an NVD score on request or never. Re-check while the finding is open rather than once at intake. When a score arrives, record the enrichment date with the value, so a report can distinguish “scored 7.5 at publication” from “scored 7.5 five weeks after triage as unknown.” The original triage reasons stay on the record; the score is added, not substituted.
In practice
- Read the full CVE record, not only the NVD fields; note whether the CNA or CISA ADP container carries CVSS, CWE or SSVC values, and attribute each.
- Display NVD status as published (“not scheduled,” “Modified After Enrichment,” and whatever label follows) rather than mapping it to a severity.
- For unscored findings, triage on presence, reachability, stated preconditions, KEV membership and dated EPSS, and record those reasons.
- Keep “severity unknown” as a distinct queue state that never sorts as low.
- Re-check enrichment while the finding is open, and store the enrichment date beside the score.
Sectie’s Exposure & Vulnerability Management product enriches findings from NVD, CISA KEV and EPSS and shows the reasons behind each priority.
