NVD stops scheduling enrichment for roughly 30,000 pre-March-2026 CVEs

"Not Scheduled" is a status field, not a severity judgment. The effect lands one layer down, in the join. Most prioritization stacks ask NVD two questions about a CVE: what is the base score, and which products does it affect. Remove both and the record does not surface as low risk ^[1]. It surfaces as absent, or as unknown, and unknown does not open tickets by itself.

The population is at least bounded. Every record in the set was published before March 1, 2026, so the set is closed and cannot grow ^[5][3]. That makes it a backfill problem rather than a permanent stream. What the source does not supply is a completion target, or the criteria by which a record leaves Not Scheduled, which means a team cannot tell today whether a given CVE is queued or parked ^[12]. NIST's own wording is not quoted in the piece; the statement is described as an April update to NVD operations, made in response to CVE volume outgrowing the enrichment model ^[4].

The sizing of the pressure comes from one interested party. The article is bylined by Gene Moody, Field CTO at Action1 ^[2], and the volume figures are from Action1's own 2026 Software Vulnerability Ratings Report: disclosures across the enterprise categories analyzed up 92% in 2025 over 2024, critical and high each up 103%, remote code execution up 128% ^[6][7][8]. That is a shade under double year over year ^[14], with the RCE subset growing 36 points faster than the whole ^[15]. The same report puts enterprise application exploitation up 800%, about nine times the prior year ^[9][16]. No independent corroboration appears in the source.

Where this does not matter much: for a vulnerability you are actually chasing, the vendor advisory arrived before NVD enrichment ever would have. Moody's own argument is that attackers correlate vendor advisories, research, patch releases and public disclosure without waiting for standardized fields ^[10]. Defenders read the same feeds. What the 30,000 lose is normalization, and normalization is what automation consumes.

Where it does matter: affected-product data. Incomplete or overly broad CPE pushes false positives up, and false positives are paid in analyst hours ^[11]. Moody expects organizations to build alternative intelligence pipelines, with the cost, tooling and operational complexity that implies, and higher failure rates with it ^[13]. For the 30,000 that leaves two workable positions: substitute a severity source the team controls and label the substitution, or make unscored its own queue that a human triages.