NIST NVD: V-etalon AI Enrichment Tool Announced After Audit Finds Backlog, Wasted Spend

What it is

NIST's National Vulnerability Database (NVD) has published a Request for Information on modernization and, in an accompanying blog post, disclosed V-etalon — an in-development, unreleased AI tool meant "to aid in enriching vulnerability information." The engineer-relevant takeaway is not the tool (which barely exists) but what NVD has already stopped doing to CVE records your tooling likely depends on.

Preconditions / Affected

This matters if any of your vulnerability workflow consumes NVD-enriched fields — CVSS severity, affected product/version (CPE) data — rather than raw CVE records or CNA/ADP data directly. Since April 2026, NVD only reliably enriches CVEs that are:

• in CISA's KEV catalog,
• in software used by the federal government, or
• in software designated critical under Executive Order 14028.

Everything else can be parked in "Not Scheduled" indefinitely, and all backlogged records published before March 1, 2026 were moved to that status.

What to do

Concrete consumption changes the page documents:

• Don't assume an NVD-supplied CVSS exists or is independent. NIST stopped routinely producing its own CVSS score when a CNA already supplied one. If you treat "NVD score" as an independent second opinion, that assumption is now wrong for many CVEs.
• Don't assume modified CVEs get reanalyzed. NIST limited reanalysis of updated CVEs.
• Ingestion ≠ enrichment. CVE records appear in NVD within ~1 hour of publication, but the operationally useful stage — severity + affected versions — is the bottleneck that is now selectively skipped. A record's presence tells you nothing about whether it was analyzed.
• Consider CISA-supplied ADP enrichment (which NVD now ingests) or CNA data directly as the source of truth for non-prioritized CVEs.

Caveats

• V-etalon is vaporware as of this writing. No release date, repository, documentation, architecture, or evaluation results. NIST does not say whether it will generate CVSS, identify CWEs, build CPE applicability statements, or validate CNA data — and describes it inconsistently (both to "aid in enriching" and as a "foundation for evaluation"). Do not plan around it.
• The RFI still asks the public which tasks are suitable for AI and what safeguards are needed — foundational design questions for a tool NIST says it has already begun building.
• This continues a pattern: automation was promised in May 2024, November 2024, March 2025, and April 2026, each time without milestones, tools, or delivery that changed NVD output. A federal audit (roughly three months before this post) found no strategic plan, no workable backlog plan, and no sustainable process. Context: CVE submissions rose 263% between 2020 and 2025.