Introduction
On April 15, the National Institute of Standards and Technology (NIST) announced a significant shift in how it enriches the National Vulnerability Database (NVD). Most Common Vulnerabilities and Exposures (CVEs) will still be published, but fewer will receive the full enrichment—CVSS scores, CPE mappings, and CWE classifications—that container scanning tools and compliance programs have long depended on. This change formalizes a trend visible over the past two years: NIST has stated clearly it will not return to full-coverage enrichment. If your container security program built its scanning, prioritization, and service-level agreement (SLA) workflows around the NVD as the authoritative secondary layer above CVEs, now is the time for a structured reassessment. This guide walks you through the key steps to adapt your strategy.
What You Need
- Current vulnerability management policy and SLA definitions for your containerized environments
- List of scanning tools and their reliance on NVD enrichment fields (CVSS, CPE, CWE)
- Inventory of software components used in containers, including open-source libraries and base images
- Access to alternative vulnerability intelligence sources (e.g., CISA KEV, vendor advisories, commercial feeds)
- Knowledge of your organization’s critical software as defined by Executive Order 14028 or internal risk assessments
- Communication channels with security teams and developers to adjust workflows
Step-by-Step Guide
Step 1: Audit Your Current Reliance on NVD Enrichment
Begin by mapping every point in your container security pipeline that consumes NVD data. This includes scanning tools, vulnerability prioritization engines, compliance dashboards, and automated patching triggers. Document which tools use CVSS scores for severity ranking, which rely on CPE mappings for asset identification, and which use CWE for root-cause classification. For each dependency, note whether the tool can function without enrichment or if it has alternative data sources built in.
Step 2: Classify Your CVEs into the New NVD Tiers
Understand which CVEs will still receive full enrichment under NIST’s new model. The three categories are:
- CVEs in CISA’s Known Exploited Vulnerabilities (KEV) catalog – these are enriched within one business day.
- CVEs affecting software used within the federal government.
- CVEs affecting “critical software” as defined by Executive Order 14028.
All other CVEs move to a “Not Scheduled” status. Also, NIST no longer duplicates CVSS scores when the submitting CNA provides one. All unenriched CVEs published before March 1, 2026 are moved to “Not Scheduled.” Identify which CVEs in your environment fall into the enriched category and which do not.
Step 3: Reassess Vulnerability Prioritization Without CVSS Scores
For the many CVEs that will now lack CVSS scores, you cannot rely solely on severity numbers. Develop alternative prioritization criteria:
- Check CISA KEV for active exploitation status.
- Consider exploit availability from public sources.
- Assess the criticality of the affected component in your infrastructure.
- Use commercial threat intelligence feeds that provide enriched data.
- Implement a risk-scoring model based on your own asset value and exposure.
Update your automated workflows to incorporate these factors instead of defaulting to CVSS.
Step 4: Update CPE Mapping Strategies
CPE mappings are critical for scanning tools to recognize which software is affected. Without full enrichment, many CVEs will lack official CPE. Work with your scanning tool vendor to ensure they support alternative matching methods, such as SWID tags, package URLs (PURLs), or custom vendor feeds. Consider maintaining a local mapping table for important software not covered by NVD. Also, request enrichment from NIST via email (nvd@nist.gov) for specific CVEs you identify as high priority, though no SLA is guaranteed.
Step 5: Integrate Alternative Vulnerability Intelligence Sources
To fill the gaps left by NVD, source data from:
- CISA Known Exploited Vulnerabilities – free and regularly updated.
- Vendor advisories – official statements from software maintainers often include community-provided CVSS and affected versions.
- Open-source advisory databases like GitHub Advisory Database or Open Source Vulnerabilities (OSV).
- Commercial feeds from companies like Qualys, Tenable, or Snyk that maintain their own enrichment.
Automate ingestion of these feeds into your vulnerability management platform.
Step 6: Revise Service-Level Agreements and Compliance Workflows
Review your SLAs for vulnerability remediation. In the past, many organizations used CVSS score thresholds to define response times. With fewer enriched CVEs, you must redefine SLAs based on available data. For example, you might set faster SLAs for CVEs in CISA KEV or those affecting critical software, and slower SLAs for unenriched CVEs that have low exploitability evidence. Communicate these changes to stakeholders and update compliance reporting.
Step 7: Plan for Ongoing Monitoring and Adjustment
NIST’s change is not static. The volume of CVE submissions is rising dramatically—NIST reported a 263% increase between 2020 and 2025, with Q1 2026 up a third from the prior year. Monitor NVD announcements and consider subscribing to the NVD mailing list. Revisit your reassessment quarterly to adjust to new enrichment patterns and tooling improvements.
Tips for Success
- Don’t panic: The majority of CVEs still receive some enrichment from CNAs; NIST’s change mainly affects the secondary enrichment that many tools relied on redundantly.
- Engage your scanning tool vendors: Ask them how they plan to handle the new NVD model and if they have fallback enrichment mechanisms.
- Prioritize by exploitability: Exploitation status is more actionable than a numeric score alone.
- Use the new NVD categories to your advantage: Focus enrichment requests on CVEs in “Not Scheduled” that are critical to your operations.
- Consider community efforts: Projects like the Open CPE Dictionary by OWASP may help fill gaps.
- Document your new workflow: Ensure your team understands how to triage CVEs without full NVD enrichment.
By following these steps, you can maintain a robust container security program even as NIST narrows its NVD enrichment scope. The key is to diversify data sources and adapt prioritization to focus on what truly matters: active exploitation and business impact.