# The CVE Backlog Is a Security Crisis in Slow Motion
Thirty thousand vulnerabilities, quietly reclassified. NIST calls it an operational adjustment. Security practitioners should call it what it is: a fundamental mismatch between how fast we're finding problems and how fast we can make sense of them.
In April, the National Vulnerability Database announced that roughly 30,000 CVEs published before March 1, 2026 had been moved to "Not Scheduled" status — meaning they won't receive the structured enrichment that makes them actionable for most security teams. The official framing was measured: volume has outpaced capacity, so triage and selective processing are necessary. That's true. It's also incomplete.
The uncomfortable part isn't the backlog itself. Every system working at scale develops backlogs. The uncomfortable part is what that backlog reveals about who benefits from the current delay — and who doesn't.
## A Volume Problem AI Made Worse (And Will Keep Making Worse)
The numbers from Action1's 2026 Software Vulnerability Ratings Report are worth sitting with. Disclosed vulnerabilities across major enterprise software categories increased 92% in 2025 compared to 2024. Critical and high-severity findings each jumped 103%. Vulnerabilities enabling remote code execution — the category that actually keeps incident responders up at night — climbed 128%.
That acceleration isn't accidental. AI-assisted code analysis tools, fuzzing infrastructure, and large language models trained on vulnerability patterns have genuinely compressed the timeline for finding flaws. Researchers who would have spent weeks auditing a codebase can now surface potential vulnerabilities in hours. Bug bounty programs are seeing surges in submission volume. Automated scanners are churning through software at a rate that was science fiction five years ago.
This is, net, a good thing. Finding vulnerabilities before attackers do is the point. But the discovery pipeline has dramatically outrun the triage infrastructure downstream of it. NIST's NVD was built for a world where vulnerability volume grew at a manageable pace. That world is gone.
## What "Enrichment" Actually Means — and Why Its Absence Hurts
The term "enrichment" sounds bureaucratic, but the data it describes is operationally critical. When a CVE gets properly processed through NVD, it comes out the other side with structured metadata: affected platform and product information (CPE data), CVSS severity scores, configuration details, and contextual references. That scaffolding is what allows a security team to answer the only question that actually matters: *does this vulnerability apply to us, and how fast do we need to move?*
Without enrichment, a CVE is effectively a rumor with an ID number. It exists. Something is wrong somewhere. But the granular details that determine whether your specific version of a specific piece of software is affected — that's missing. Teams are left with a choice between waiting for enrichment that may not come on any predictable schedule, or doing their own triage with incomplete data.
Neither option is good. Waiting means latency in a threat environment where exploitation timelines have compressed to days or hours in some cases. Acting on partial data means misallocating scarce remediation resources — chasing vulnerabilities that don't actually affect your environment while real exposure goes unaddressed.
## Attackers Don't Wait for the NVD
Here's the asymmetry that doesn't get talked about enough: threat actors operating at any serious level of sophistication are not consulting NVD as their primary intelligence source.
They're reading vendor advisories the day they drop. They're monitoring security researcher Twitter accounts, watching GitHub commits for patch diffs, scraping exploit databases, and correlating public proof-of-concept code with known-exposed targets. The enrichment lag that creates friction for defenders is irrelevant to their workflow. They've already correlated the patch notes, reverse-engineered the fix, and identified which organizations haven't yet patched.
The 30,000 unenriched CVEs in limbo include vulnerabilities that may already be the subject of active vendor advisories, research publications, and attacker interest — just without the standardized NVD wrapper that security teams have been trained to use as their queue. That information asymmetry is exactly the kind of structural gap that well-resourced threat actors exploit.
## The False Positive Tax
There's a second-order effect that's harder to measure but operationally real. When CPE (Common Platform Enumeration) data is incomplete or overly broad — which happens when enrichment is rushed or absent — organizations face elevated rates of false positives in their vulnerability scanning and management tools.
False positives aren't just noise. They're a tax on analyst time. Every hour a security engineer spends verifying that a flagged vulnerability doesn't actually apply to their environment is an hour not spent on the things that do. In security teams that are already stretched, the compounding effect of elevated false positive rates degrades the entire patch management workflow. SLAs slip. Genuine risk gets buried under volume.
The selective processing model NIST has adopted — prioritizing newer CVEs over older unenriched ones — also creates a perpetual uncertainty problem. At any given moment, practitioners can't easily determine whether a specific CVE falls in the "will be processed soon" category or the "indefinite limbo" category. That ambiguity makes it harder to calibrate confidence in NVD as a normalized data source.
## What Organizations Actually Need to Do Now
This isn't a situation where waiting for NIST to solve the problem is an acceptable posture. The volume trajectory suggests it gets harder before it gets easier. Practical adjustments matter now:
Diversify intelligence sources. NVD is one input, not the pipeline. Vendor advisories, CISA's Known Exploited Vulnerabilities catalog, threat intelligence feeds, and sector-specific ISACs provide signal that doesn't depend on NVD enrichment timelines.
Invest in contextualization tooling. Teams that can automatically correlate a CVE against their actual software inventory — without waiting for CPE data — are less exposed to the enrichment lag. This means accurate, up-to-date asset management, which is harder than it sounds.
Reprioritize on exploitation evidence, not just severity scores. CVSS is a normalized severity estimate, not a prediction of exploitation likelihood. CVEs showing up in CISA KEV, exploit databases, or credible threat intelligence reporting deserve attention independent of where they sit in the NVD queue.
---
## HackWire Analysis
The NVD enrichment crisis is a preview of a broader reckoning the security industry isn't ready to have.
AI-assisted vulnerability discovery is becoming a standard capability. The next generation of automated fuzzing tools, LLM-assisted code auditing platforms, and coordinated bug bounty programs will continue to drive disclosure volume upward. There's no reason to expect the 92% growth figure from 2025 to be the peak — it may represent the new floor.
The infrastructure that the security industry has built to manage vulnerability information was designed around the assumption of manageable volume growth. NIST's NVD, the CVE numbering authority system, CVSS scoring — all of it was architected for a slower world. We've broken those assumptions, and the visible symptom is 30,000 unenriched vulnerabilities and an announcement that enrichment capacity can't keep pace.
What's underreported in the coverage of this issue is the downstream effect on smaller organizations. Large enterprises with dedicated threat intelligence teams can compensate for NVD enrichment gaps by pulling from multiple authoritative sources and maintaining internal triage capacity. A 200-person company relying on a two-person security team and vulnerability management software that normalizes against NVD? They're flying partially blind in a way they may not fully recognize.
The response can't just be "move faster." It requires rearchitecting how vulnerability intelligence gets produced, enriched, and distributed — possibly with AI assistance in the enrichment pipeline itself. The irony of using AI to help manage the backlog that AI helped create is obvious. It's also probably the right answer.
The gap between attacker intelligence velocity and defender intelligence latency is the real risk metric here. Right now, that gap is widening.
— HackWire Editorial
---
## Related Coverage