NIST’s National Vulnerability Database Update and the Vulnerability Enrichment Ecosystem

NIST’s National Vulnerability Database Update and the Vulnerability Enrichment Ecosystem

Speakers: Harold Booth, National Institute of Standards and Technology (NIST)

Conference: VulnCon

YouTube: https://www.youtube.com/watch?v=bBunxDmWb0A

Overview

Harold Booth from the National Institute of Standards and Technology (NIST) delivered a critical update on the state of the National Vulnerability Database (NVD) and its evolving role within the broader vulnerability enrichment ecosystem. The talk addressed the escalating challenges faced by the NVD due to the exponential growth in CVE identifier (CVE ID) publications and the increasing complexity of vulnerability data. Booth outlined NIST's strategic shift from attempting to enrich every incoming CVE to adopting a risk-based prioritization model, aiming to maximize impact for defenders with limited resources.

This presentation is highly significant for anyone involved in cybersecurity, from PSIRTs (Product Security Incident Response Teams) and vulnerability management professionals to government agencies and software developers. The NVD serves as a foundational source of vulnerability information, providing crucial metadata like CPE (Common Platform Enumeration), CWE (Common Weakness Enumeration), and CVSS (Common Vulnerability Scoring System) scores. The changes announced by NIST will directly impact how organizations consume, process, and prioritize vulnerability intelligence, necessitating adjustments in their security operations and tooling.

Booth emphasized that the NVD's current manual processes are unsustainable against the backdrop of an ever-expanding threat landscape and the "industrialization of CVE" facilitated by a growing number of CNA (CVE Numbering Authority) partners. The talk not only detailed immediate process changes but also laid out a forward-looking vision involving automation through LLMs (Large Language Models) and AI agents, as well as a call for community collaboration to build a more robust and scalable vulnerability information ecosystem.

Background

▶ Watch: NVD's historical role and metadata enrichment (4:00)

The journey of vulnerability identification and enrichment began with a focus primarily on the CVE identifier itself, aiming for common enumeration and basic metadata like descriptions and reference links. However, the need for more comprehensive metadata quickly emerged, leading to the establishment of the NVD by NIST. Initially, the NVD augmented CVEs with product information (vendor, product, version), which later evolved to incorporate CPE. It also introduced categorization using CWEs (starting with a small subset and expanding over time) and severity scoring using CVSS, progressing from 1.0 to 2.0, and currently using 3.1, with investigations into 4.0.

A pivotal shift occurred around 2016, termed the "industrialization of CVE," which saw a dramatic increase in the number of CNAs. Previously, CVE ID assignment was a laborious, manual process handled by a few individuals. The expansion of the CNA program empowered organizations to independently publish their own CVE IDs, a significant departure from earlier requirements where all IDs had to be vetted and approved before publication. This decentralization was a huge success in terms of scale, with the number of CNAs growing to an impressive 502 globally.

However, this success brought new challenges. The increased volume of CVEs led to concerns about data quality, consistency in abstraction and counting, and the reliability of reference links (often resulting in 404 errors). New questions arose for the NVD, particularly around accurately identifying affected products and maintaining consistent CVSS scoring across a diverse set of CNAs. The NVD found itself struggling to keep pace, with its backlog steadily increasing. Booth highlighted that over half of NVD's analysis time is dedicated solely to assigning CPEs, a task made more challenging by the proliferation of GitHub-based projects and the increasing complexity of product versioning. This unsustainable situation underscored the urgent need for a strategic overhaul of NVD's operations.

Key Findings

▶ Watch: Challenges of scaling CVEs and data quality issues (8:00)

The central finding presented by Harold Booth is that the NVD can no longer sustain its previous model of enriching every single CVE identifier due to an overwhelming increase in volume and complexity. The "industrialization of CVE," while a success in scaling vulnerability identification, has inadvertently created a data quality and processing bottleneck at the NVD. With 502 CNAs now publishing CVEs, the influx of new vulnerabilities far outstrips NVD's current manual processing capacity, leading to a massive and growing backlog.

This critical situation necessitates a fundamental shift in strategy. Booth announced that the NVD is transitioning to a risk-based prioritization approach. Instead of attempting to provide comprehensive enrichment for all CVEs, the NVD will now focus its limited resources on the vulnerabilities deemed most critical and impactful to defenders. This selective enrichment aims to ensure that high-priority vulnerabilities receive timely and thorough analysis, while a significant portion of other CVEs may receive minimal or no NVD-specific metadata. This strategic pivot acknowledges the practical limitations of a centralized enrichment model in an increasingly decentralized and high-volume vulnerability disclosure landscape.

Technical Deep Dive

▶ Watch: New NVD prioritization criteria for vulnerability enrichment (17:00)

NIST’s strategic update to the National Vulnerability Database (NVD) involves several critical changes, moving away from a comprehensive enrichment model to a risk-based, prioritized approach. These changes are designed to address the overwhelming volume of CVE identifier (CVE ID) submissions and the limitations of current manual processing.

Prioritization Criteria

The NVD is implementing a new prioritization criteria to determine which CVEs receive full enrichment. This multi-tiered approach focuses on maximizing impact for the broader defense community:

1. Known Exploited Vulnerabilities (KEV) List: CVEs appearing on the CISA KEV list will be the highest priority. The NVD aims to enrich these within one business day, recognizing their immediate threat and operational urgency. This ensures that information on actively exploited vulnerabilities is disseminated rapidly.
2. Software Used within the Federal Government: The NVD will prioritize CVEs affecting software prevalent within federal government systems. This category is expected to largely overlap with software commonly used across many U.S. businesses, providing a broad benefit.
3. Critical Software: This category reuses the definition established in response to Executive Order 14028. Critical software is defined as software designed to run with elevated or managed privileges, have direct or privileged access to networking or computing resources, control access to Operational Technology (OT), or perform critical functions to trust, or operate outside normal trust boundaries with privileged access. This ensures focus on vulnerabilities that could have systemic or high-impact consequences.

For CVEs that do not meet these criteria but are deemed important by external parties, NIST is establishing a feedback mechanism. Users can send an email to [email protected] or, if the community prefers, a GitHub repository could be set up for public tracking of such requests.

Streamlining Severity Scoring

To manage the workload associated with CVSS scoring, the NVD will streamline its process:

• No Routine Gap Filling: The NVD will no longer routinely score vulnerabilities that already have a published CVSS score from the CNA or other sources. This formalizes a previous discussion around "gap filling."
• Exceptions: Scores may be revisited if NVD analysts, during other analysis (e.g., CPE assignment), find a significant discrepancy between an existing score and the vulnerability information. Additionally, the NVD will review and potentially re-score a CVE if specifically requested by a user. This service will be provided upon request but will not be a routine part of the NVD's process.

Handling Modified CVEs

The NVD has a substantial backlog of modified CVEs—those that changed after initial NVD enrichment. These modifications can range from minor tweaks to significant alterations in affected products or descriptions.

• New Status: The NVD will mark all such CVEs with a new status: "modified after enrichment," making their state clearer.
• No Routine Re-evaluation: Going forward, the NVD will generally not revisit or re-enrich these modified CVEs unless specific conditions are met.
• Re-enrichment Conditions: Re-enrichment will occur if material information becomes available that would significantly alter the NVD's data (e.g., new affected products are identified), or if a user specifically requests a re-evaluation.

CVE Backlog Management

The existing backlog of un-enriched CVEs is substantial and, under current processes, unmanageable. To address this:

• "Not Scheduled" Status: All CVEs published before March 1st of the current year will be moved to a new status called "not scheduled" (reusing the "deferred" API label for backward compatibility). These CVEs will not be routinely processed by the NVD.
• Focus on New CVEs: The NVD will prioritize processing CVEs published after March 1st, focusing on the most recent and relevant vulnerabilities, particularly those meeting the new prioritization criteria. Again, a request mechanism (email or GitHub) is available for users who believe a "not scheduled" CVE warrants NVD attention.

New Status Labels

To improve transparency and communication regarding a CVE's position within the NVD's processing pipeline, several status labels have been renamed. The goal is to provide clearer visibility into what actions, if any, the NVD is taking on a particular vulnerability.

Looking Ahead: Automation and Community Engagement

Booth also outlined future directions for the NVD, heavily focusing on automation and federated approaches:

• Automation with LLMs and AI Agents: NIST is actively exploring the use of Large Language Models (LLMs) and AI agents to automate as much of the enrichment process as possible. The aim is to develop an open-source framework for these agents, inviting community feedback and contributions.
• Robotic Process Automation (RPA): Alongside AI, RPA will be utilized to automate deterministic, rule-based tasks within the NVD's workflow.
• Federated CPE Management: Recognizing the burden of CPE assignment (which consumes over half of NVD's analysis time), NIST is investigating ways to federate CPE management. This involves collaborating with CNAs and CVE working groups to distribute the responsibility for product identification and versioning in a sustainable manner.
• Crowdsourcing: The NVD is considering enabling forms of crowdsourcing for vulnerability data enrichment, potentially through exposed APIs and web interfaces, to leverage broader community expertise.

Broader Data Quality and Ecosystem Considerations

Beyond NVD's internal processes, Booth raised fundamental questions about the desired state of vulnerability data quality and the ecosystem:

• Product Information: The tension between unique product identification (e.g., a specific software build) and applicability/affectedness (e.g., a range of versions) remains a challenge. While CPE was an attempt to solve this, it has known limitations. PURL (Package URL) is another approach, better for identity but still facing applicability issues. Booth emphasized the need for discoverable and aggregated product information, not just vendor-managed data.
• Priority Information: How to effectively prioritize vulnerabilities without overloading all stakeholders. The idea of combining generic prioritization schemes (like CVSS or SSVC (Stakeholder-Specific Vulnerability Categorization)) with local, context-specific information was discussed.
• Impact and Remediations: The need for better standardized descriptions of vulnerability impact and clear, actionable remediation guidance.

Booth concluded with a call for community engagement, urging participation in workshops, events, and open projects, and encouraging feedback to [email protected] to help shape the future of vulnerability information.

Demo / Proof of Concept

▶ Watch: Future plans: AI/LLM automation, federation, crowdsourcing (24:00)

The talk did not include a live demonstration or proof of concept. Harold Booth discussed the NVD's future plans to develop and release LLMs and AI agents as an open-source project for automating enrichment tasks, but these are currently under development and were not presented as a working demo.

Defensive Implications

▶ Watch: Q&A: Third-party help for CPE and CNA responsibility (34:50)

The changes outlined by Harold Booth at NIST have profound implications for defenders and vulnerability management programs. Organizations must adjust their strategies to account for the NVD's new prioritization model and reduced universal enrichment.

1. Prioritization Alignment: Defenders should align their internal vulnerability prioritization with NVD's new focus areas: KEVs, federal government software, and critical software. This means immediately acting on KEVs (within one business day as NVD aims to enrich them) and paying close attention to vulnerabilities in their critical infrastructure and widely used software.
2. Reduced Universal Enrichment: Recognize that not every CVE identifier will receive comprehensive NVD enrichment (CPE, CWE, CVSS score, detailed references). For many CVEs, especially those not on the prioritized lists or in the "not scheduled" backlog, defenders will need to rely more heavily on the original CNA data, vendor advisories, and other intelligence sources.
3. Proactive Information Gathering: Organizations should develop robust processes for gathering vulnerability information directly from CNAs, vendor security advisories, and industry-specific threat intelligence feeds. This includes monitoring for CVSS scores and affected product details provided by the original reporters, as NVD will no longer routinely gap-fill scores.
4. Engage with NVD for Critical Gaps: For specific, high-priority CVEs that are not being enriched by the NVD but are critical to an organization's posture, defenders can leverage the new feedback mechanism ([email protected] or potential GitHub repository) to request NVD attention.
5. Contribute to the Ecosystem: Booth's call for community engagement is an opportunity for defenders to shape the future of vulnerability data. Participating in workshops, providing feedback, and contributing to open-source projects (like the proposed LLM and AI agent framework) can help build a more resilient and automated ecosystem that benefits everyone.
6. Strengthen Internal Product Identification: The ongoing challenges with CPE highlight the need for organizations to improve their internal asset inventory and software bill of materials (SBOM) capabilities. Accurate product identification is crucial for determining applicability when NVD data might be less comprehensive.
7. Anticipate Automation Benefits: While immediate changes require manual adjustments, defenders should look forward to the potential benefits of LLM and AI agent automation. A more efficient NVD, and potentially CNA tools built upon the same open-source frameworks, could lead to faster, more consistent, and higher-quality vulnerability data in the future.

Key Takeaways

• The NVD is undergoing a significant strategic shift, moving from attempting to enrich all CVE identifiers to a risk-based prioritization model due to unsustainable growth in vulnerability publications.
• High-priority CVEs, specifically those on the KEV list, affecting federal government software, or designated as critical software (per Executive Order 14028), will receive focused and timely enrichment.
• The NVD will no longer routinely provide CVSS scores for CVEs that already have one, nor will it typically re-evaluate modified CVEs or process the extensive backlog of CVEs published before March 1st of the current year.
• NIST is actively exploring LLMs, AI agents, and RPA for automating vulnerability enrichment and is seeking community collaboration for federated CPE management and crowdsourcing initiatives.
• Defenders must adapt by aligning their vulnerability management programs with NVD's new priorities, relying more on original CNA data, and proactively engaging with NIST through feedback channels for specific, critical CVEs.
• The talk underscored the persistent challenges in consistent product identification (CPE, PURL), vulnerability impact description, and remediation guidance within the broader vulnerability ecosystem, inviting collective effort to find sustainable solutions.

About the Speaker(s)

Harold Booth is a representative from the National Institute of Standards and Technology (NIST), where he plays a key role in the management and evolution of the National Vulnerability Database (NVD). His work involves addressing the significant challenges posed by the increasing volume and complexity of vulnerability data, and strategizing future directions for the NVD to better serve the cybersecurity community. Booth has a deep historical perspective on the development of vulnerability enumeration and metadata standards, having been involved with the NVD's operations and the broader CVE program for many years. He is actively engaged in seeking community input to shape the future of vulnerability information sharing.