NIST Asks How AI Should Run the Vulnerability Database. Your Scanner Already Depends on the Answer.

“Without significant changes to how it is managed, the NVD will not be a reliable piece of the nation’s cybersecurity infrastructure.” That’s the Commerce Department’s inspector general, writing about NIST’s National Vulnerability Database on May 26 [3].

On August 12, NIST published its answer, or the start of one: a request for information asking how the database should work “in the Age of Artificial Intelligence” [1]. It’s a list of questions, not a plan. But if your dependency scanner, your SBOM tooling or your customer’s compliance checklist pulls from the NVD, those questions are about your pipeline.

What NIST is asking

The notice comes from NIST’s Information Technology Laboratory under docket NIST-2026-0100, and comments are due October 13 [1]. NIST says it wants to improve the database’s “scalability, automation, interoperability, transparency, and utility” [1].

The setup is short. The NVD pulls in new CVE records within about an hour of publication, and analysts then add severity scores and affected product versions, a step NIST calls enrichment [1]. The notice says AI-enabled tools and faster release cycles are changing the work, and that “Malicious actors may seek to leverage AI systems to discover and exploit vulnerabilities at scale” [1]. It concludes that approaches built on “periodic scanning, static prioritization, and manual remediation” are increasingly inadequate [1].

The questions sit in seven groups [1]. The ones I’d read first:

• Human review. Which tasks suit AI-enabled automation, which should require human review, and how to set up reviews “to both minimize time spent and avoid over-reliance on AI” [1].
• Auditability. How to make AI-driven prioritization decisions more transparent and auditable [1].
• Automated fixes. What role, if any, AI systems should have in automated remediation, and what “controls and safeguards are needed to prevent erroneous AI-generated remediations” [1]. It also asks what open-source projects need to manage AI-generated patches [1].
• The data itself. Whether today’s identifiers, product naming schemes and severity scoring systems are good enough “in the AI era” [1].

A NIST spokesperson told Nextgov/FCW the request “is not in response to any specific executive orders or to the Gold Eagle Initiative,” a clearinghouse for AI threat information [5]. CyberScoop reported that Gold Eagle, overseen by Treasury, rolled out about a month before the RFI, and that it isn’t clear how it will interact with the NVD [4].

How the NVD fell behind

The backlog started in February 2024, when NIST’s enrichment support contract lapsed and processing nearly stopped, according to the inspector general [3]. NIST signed a new contract in May 2024 and said publicly the backlog would be gone by the end of that September [3]. Instead it grew from about 13,000 vulnerabilities in June 2024 to more than 27,000 by the end of 2025 [3].

On April 15 of this year, NIST changed the rules. CVE submissions rose 263 percent between 2020 and 2025, and the first quarter of 2026 ran nearly a third above the same period a year earlier [2]. NIST enriched nearly 42,000 CVEs in 2025, it said, and still couldn’t keep up [2]. So it now enriches three categories first: CVEs in CISA’s Known Exploited Vulnerabilities catalog, with a goal of one business day, CVEs for software the federal government uses, and CVEs for critical software as Executive Order 14028 defines it [2]. Everything else is still listed, labeled “Lowest Priority - not scheduled for immediate enrichment” [2]. Backlogged CVEs published before March 1, 2026 went to a “Not Scheduled” category [2]. NIST also stopped routinely adding its own severity score when the CVE Numbering Authority had already given one [2].

Six weeks later the inspector general’s report landed. It found no strategic plan for the NVD, enrichment of Known Exploited Vulnerabilities entries that missed a one-weekday benchmark 34 percent of the time from February 2024 through December 2025, and enrichment work at NIST and CISA that overlapped [3]. It projects more than 60,000 reported vulnerabilities this year [3]. In the 30 days before April 7, NIST counted about 300,000 unique users downloading an average of 22 terabytes a day [3].

Each side’s case

NIST’s position is that triage was the only workable option. Its April notice says CVEs outside the priority categories “generally do not present the same level of systemic risk,” while admitting the criteria “may not catch every potentially high-impact CVE” [2]. In its response to the inspector general, NIST concurred with all six recommendations but argued the report should have noted that the contract lapse coincided with “the widespread use of artificial intelligence and the rapid proliferation of discovered vulnerabilities” [3]. The RFI is that argument turned into questions: the volume is the problem, so automation is the fix [1].

The inspector general’s view is that the trouble is management. It wrote that NIST’s actions on the backlog don’t reflect its own description of the NVD as key infrastructure, and that NIST “did not have a plan or take decisive action” on the 2024 goal [3]. It surveyed signers of a 2024 open letter from more than 50 security professionals: 75 percent said they rely on the NVD less now, and 90 percent were unhappy with how often NIST reported on the backlog [3]. Eighty percent still said the database offers unique enrichment data [3].

One detail from the report belongs next to the RFI. Three OIG cybersecurity specialists scored the same 69 vulnerabilities and produced identical CVSS vector strings only 8 times, 12 percent [3]. The OIG then ran the test with an AI model and “found a similar level of inconsistency” [3].

What it means if you ship software

This is my read, and it’s opinion.

Check what your tools do with unenriched CVEs. The inspector general calls the product applicability statements, the machine-readable lists of affected versions, “critical for automated vulnerability management,” and says NIST is now the only government source for them after CISA stopped producing them in December 2024 [3]. A CVE marked lowest priority may never get one [2]. If your scanner matches on NVD product data, a real vulnerability in a niche dependency can sit unmatched. Ask your vendor which other sources it uses to fill the gap.

If you’re a CNA, your data is the record now. With NIST deferring to the submitter’s severity score [2], the score you file is the one many downstream tools will show. The inspector general notes even large vendors struggle to format product statements to NIST’s standard, and that NIST is building a console for outside contributions to the product dictionary [3]. Good submissions are the cheapest fix anyone has.

The AI question is a governance question. I’m glad NIST is asking about human review and auditability before it ships anything [1]. Still, the OIG’s scoring test is the caution here: when the people disagree with each other, a model trained on their output inherits the disagreement [3]. An RFI that asks how to automate scoring should also ask what “correct” means. Question 5(b) comes closest [1].

Process. An RFI is the right first step, and comments are open to anyone [1]. But the inspector general asked for a strategic plan, and NIST told the OIG in December 2025 that it was writing one [3]. I’d like to read that plan before commenting on the architecture it’s supposed to produce.

What I’m watching

• October 13. Comments close [1]. Watch whether scanner vendors and open-source foundations file, since the remediation questions land on them.
• The OIG action plan. The inspector general asked for one within 60 calendar days of May 26 [3]. Whether NIST publishes it, or the strategic plan, is the next real signal.
• Gold Eagle and the NVD. Two federal vulnerability efforts with no stated link [4, 5]. The OIG already found NIST and CISA duplicating work [3].