Modernizing the National Vulnerability Database for Growing Cyber Risks
Cyber vulnerabilities are growing in frequency, complexity, and severity. In May 2026, the Commerce Department’s Inspector General issued a report finding significant operational and governance failures within the National Institute of Standards and Technology’s (NIST) National Vulnerability Database (NVD) and directed the agency to develop a plan to address them. As NIST prepares its strategy, it should prioritize reforms that improve cross-agency coordination, modernize infrastructure, and rebuild trust within the cybersecurity community.
Managed by NIST, the NVD serves as the federal government’s primary repository of publicly disclosed cybersecurity vulnerabilities. Organizations use this database to assess and prioritize cyber risk, such as helping a federal agency determine whether a newly disclosed vulnerability threatens a public-facing system. Many organizations integrate the NVD into their cybersecurity tools and risk management processes, and delays or gaps in its data can affect both government and industry preparedness. The inspector general’s report found that the NVD suffers from significant backlogs, inefficient processing of new vulnerabilities, duplication of efforts with other federal agencies, and limited stakeholder engagement, underscoring the need for modernization.
One of the most pressing issues the report identifies is an overlap between NIST and the Cybersecurity and Infrastructure Security Agency (CISA). CISA focuses on helping organizations respond to active cyber threats, such as through the Known Exploited Vulnerability catalog, while NIST is responsible for maintaining the vulnerability data and standards that underpin the broader cybersecurity ecosystem. However, as the NVD backlog has grown, CISA has expanded its own vulnerability analysis work, known as the Vulnrichment program, to support operational needs, causing both agencies to review similar information in areas such as vulnerability classification and enrichment.
To reduce duplication, NIST and CISA should establish a formal division of labor through an interagency agreement that preserves CISA’s lead role in addressing time-sensitive and actively exploited vulnerabilities. CISA would continue prioritizing immediate threats, while NIST would support those efforts by providing product-identification data for high-priority cases as it continues to maintain the NVD. The agencies should support structured information-sharing through a shared dashboard that provides real-time updates on vulnerability status and processing progress.
Meanwhile, to reduce its backlog, NIST should modernize how it processes and analyzes vulnerabilities. As reported vulnerabilities continue to rise, the inspector general’s report estimates that the backlog could grow from approximately 27,000 cases at the end of 2025 to 60,000 by the end of 2026. Analysts spend considerable time reviewing vulnerability information from trusted software vendors and security organizations. This reliance on a manual process limits the NVD’s ability to keep pace with the growing demand for vulnerability data.
NIST should maintain expert review for complex cases but introduce automated tools to identify missing information and duplicate submissions, validate vulnerability data, and prioritize review efforts based on risk and completeness. This combination of manual and automated processes would increase efficiency, reduce administrative burdens, and enable future growth while preserving human oversight and allowing analysts to focus on disputed, high-impact, or unusually complex vulnerabilities.
This modernization effort should extend to the systems that support the NVD. One example is the Common Platform Enumeration (CPE), which maintains product information associated with software and hardware vulnerabilities. Today, vendor-based updates to the CPE still rely on email-based submissions and manual review, creating unnecessary delays. NIST should develop a secure online portal that enables vendors, researchers, and other stakeholders to submit updates directly, with automated validation tools screening entries before human review and tracking submission status. Streamlining these systems would improve efficiency and data quality across the vulnerability management ecosystem.
Finally, NIST should place greater emphasis on stakeholder engagement, transparency, and confidence-building. The inspector general’s report found that stakeholders had few opportunities to provide structured feedback. For example, a 2024 letter from 50 leading cybersecurity organizations that raised concerns about the vulnerability backlog went unanswered.
To strengthen collaboration, NIST should establish a permanent NVD Stakeholder Advisory Council composed of representatives from industry, academia, government, and the research community. Similar to CISA’s stakeholder town halls, quarterly or biannual meetings could help identify challenges and evaluate modernization efforts. NIST should also publish performance metrics on backlog reduction and processing timelines. Such measures would help rebuild trust in the NVD while giving stakeholders a clearer understanding of the program’s performance and priorities.
The National Vulnerability Database remains a valuable resource supporting vulnerability management across government and industry. By reducing overlap and increasing coordination with CISA, modernizing vulnerability processing, improving support infrastructure, and strengthening stakeholder engagement and transparency, NIST can address its shortcomings and ensure the NVD remains a trusted and scalable cybersecurity resource for years to come.
