The private sector probably isn’t coming to save the NVD
Summary: Cisco Talos reports that thousands of CVEs in the U.S. National Vulnerability Database remain without analysis data, and NIST says it could take up to 100 days to catch up assuming no new vulnerabilities are disclosed in that period. NIST hopes to launch a consortium to rebuild or replace the NVD, but Talos argues private companies lack incentive to build their own database, and volunteer projects like "NVD Data Overrides" cannot assign official CVSS scores because only the NVD is authorized to do so.
Why it matters: Security teams depend on NVD severity scores to prioritize patching, and a backlog that could take 100 days to clear leaves thousands of CVEs without the analysis data that triage depends on. Whoever fills the gap also has to play referee between vendors like Microsoft or Apple and researchers disputing a 9.5 CVSS score, a role Talos sees no private-sector incentive to take on.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026