Skip to content

Back to the catalog

Socket: Federal Audit
socket.devarticle

Socket: Federal Audit

Socket covers a newly released Department of Commerce OIG audit that found NIST had no strategic plan for managing the National Vulnerability Database, set an enrichment deadline it lacked capacity to meet, and delayed using CISA's Vulnrichment data out of attribution concerns. The audit also found NIST and CISA duplicated at least 21,000 enrichment activities through the same contractor (an estimated $200K wasted), that 34% of CISA KEV vulnerabilities were not enriched in a timely manner, and that CVSS/CPE manual scoring consumed ~80% of processing time while the backlog grew from ~13,000 to over 27,000 CVEs. The piece ties the audit to NIST's April 2026 move to a risk-based enrichment model that leaves most CVEs unenriched.

TL;DR Federal OIG audit confirms NIST had no plan to fix the NVD backlog, wasted ~$200K duplicating CISA's enrichment work, and left over a third of KEV vulnerabilities without timely CVSS/CWE/CPE data.
Open original ↗
Document

What it is

A Socket writeup of the U.S. Department of Commerce Office of Inspector General audit of NIST's National Vulnerability Database (NVD), covering NVD management from October 2023 through December 2025. The audit concludes NIST "does not have sustainable processes to manage NVD submissions" and "will be unable to clear the backlog of unprocessed vulnerabilities or prevent future processing delays without significant changes."

How it works (the new enrichment model you must plan around)

Under NIST's risk-based model, only three classes of CVE get routine enrichment:

  • vulnerabilities in CISA's Known Exploited Vulnerabilities (KEV) catalog,
  • software used by the federal government,
  • software designated critical under Executive Order 14028.

Everything else can be moved to "Not Scheduled," a status that leaves records without the CVSS, CWE, and CPE fields that automated tooling depends on. Separately, in April 2025 NIST swept 100,000+ older CVEs into a "Deferred" status, further reducing the pool that will ever be enriched.

Preconditions / Affected

This matters if your vulnerability management pipeline consumes NVD-enriched fields — CVSS scores, CWE classifications, or CPE product matches — for CVEs. Any workflow that assumes every published CVE eventually receives NVD metadata is now broken for the majority of CVEs. A CVE outside the three priority buckets should be assumed to have no NVD-supplied severity, weakness, or affected-product data.

What to do

The page states no commands or patches — the action is operational, not a fix:

  • Stop treating NVD as the authoritative enrichment source for all CVEs. Assume metadata exists only for KEV-listed, federal-use, and EO 14028 critical software.
  • For everything else, source CVSS/CWE/CPE from alternatives (CNA-supplied data, the CVE record itself, or third-party enrichment).
  • Prioritize KEV membership directly, since that is what NIST itself now prioritizes.
  • Re-check any tooling that fails open or fails closed on missing NVD fields — "Not Scheduled" and "Deferred" records will surface as gaps.

Caveats

  • The audit reflects OIG's findings and NIST's own admissions, not an independent capacity measurement beyond the auditors' estimate: NIST needed ~6,200 vulnerabilities/month to hit its September 2024 goal, had never exceeded ~5,000/month, and topped out near ~5,300/month even under best-case staffing — so the deadline was mathematically unachievable from the start.
  • The findings are historical (through December 2025); they document why the risk-based model exists but do not promise it will keep pace with future CVE volume.

Timeline

timeline
    Feb 2024 : Contract lapse begins backlog
    Mar 2024 : NVD halts CVE enrichment
    Sep 2024 : Self-imposed deadline missed
    Nov 2024 : Backlog tops 20,000 CVEs
    Apr 2025 : 100K+ CVEs swept to Deferred
    May 2025 : OIG audit opened
    Apr 2026 : Risk-based model formalized

Organisations named here

  • Brian Martin
  • CISA
  • Commerce OIG
  • MITRE
  • Vulnrichment

Technologies named here

  • National Vulnerability Database
  • CISA Vulnrichment
  • CISA Known Exploited Vulnerabilities Catalog
  • CVE Program / CNAs
  • CVSS
  • CWE
  • CPE
  • VulnDB
  • NVD
  • NIST
  • CISA KEV
  • Executive Order 14028

Related in GRC