Global Economy — 2026-06-01

Federal Audit Reveals NIST National Vulnerability Database Plagued by Poor Planning and Duplicated Work With CISA

BLUFNVD's 12% scoring accuracy and 27,000-entry backlog have likely rendered the federal government's primary vulnerability prioritization tool unreliable for defensive planning until corrective actions take hold.

A Department of Commerce Office of Inspector General audit released on May 29 found NIST operated the NVD without a strategic plan and let its enrichment contract lapse in February 2024 despite two years' advance notice 12. The unprocessed vulnerability backlog grew from roughly 13,000 in mid-2024 to over 27,000 by end of 2025, and NIST's severity scores matched independent evaluators only 12% of the time despite vendors providing scores on nearly 80% of submissions 12. The OIG documented at least 21,000 instances of duplicated enrichment work between NIST and CISA, with both agencies contracting the same vendor, wasting approximately $200,000 1. NIST accepted all six recommendations and must submit a corrective action plan by July 25, 2026 12.

Analysis
At 12% score-match against independent evaluators, NVD's enrichment function has collapsed as an analytical prioritization tool, a finding confined to the Commerce OIG audit with no independent corroboration. NIST is likely to submit a corrective action plan by the July 25, 2026 OIG deadline. Moderate confidence: the agency accepted all six recommendations, though its history of missing self-imposed targets and the structural scale of the failures undercut that signal. CISA's Vulnrichment program and commercial alternatives may have already absorbed enough of NVD's core function that the degradation poses less operational risk to defenders than the audit implies. Federal agencies and vendors running NVD-integrated prioritization tools need the corrective plan's specifics to determine whether to restore reliance on NVD data or commit to alternatives.

3 sources

Federal audit reveals NISTs NVD is plagued by poor planning and duplication - CyberScoop
How NIST fumbled management of the National Vulnerability Database - Help Net Security
Audit of NIST's Management of the National Vulnerability Database - Department of Commerce Office of Inspector General