The National Institute of Standards and Technology announced it will stop enriching CVE entries disclosed before March 2026, shifting focus to newer, exploited flaws [1].

The move comes as the National Vulnerability Database faces a record surge in vulnerability disclosures, straining resources and prompting the agency to prioritize data that security teams need most [2][3].

Cybersecurity teams that rely on NIST‑provided enrichment for vulnerability analysis must now adjust their workflows—many have built automated tools around the detailed metadata NIST traditionally supplied. Without that enrichment, organizations will need to supplement their data pipelines with vendor feeds or open‑source projects that track exploit status and remediation guidance.

Industry groups are already discussing how to fill the gap left by NIST. The Information Security Forum and several open‑source communities said they will expand their own enrichment programs to cover older CVEs, aiming to keep analysts from losing visibility into legacy weaknesses [2].

Analysts warn that the loss of standardized enrichment could slow patch‑prioritization for older vulnerabilities, increasing the window of exposure for systems that have not yet been updated. While the policy targets pre‑March 2026 entries, many of those flaws remain present in legacy infrastructure that is still widely deployed.

NIST said the policy will free staff to concentrate on high‑impact, actively exploited vulnerabilities, improving the timeliness of critical updates for the most pressing threats [1].

The change underscores a broader shift in how public‑sector agencies manage the growing volume of security data, balancing comprehensive coverage with realistic resource constraints.

“NIST will stop enriching CVE entries disclosed before March 2026.”

What this means: By narrowing its enrichment scope, NIST aims to keep pace with a flood of new disclosures, but the decision pushes the burden of maintaining historical vulnerability context onto private and open‑source actors. Organizations that rely on the NVD’s enriched data will need to integrate additional sources or risk slower response times to older, still‑relevant flaws.