The National Institute of Standards and Technology (NIST) is revamping how it deals with cybersecurity vulnerabilities amid overwhelming numbers of issues, with only the most severe cases set to receive full analysis.

Traditionally, common vulnerabilities and exposures (CVEs) across software and hardware systems are tracked and analyzed by NIST, with a publicly accessible database providing exhaustive details of flaws, a score based on their severity, and possible fixes.

But the agency claimed it's seen a “surge” in vulnerability submissions, resulting in a 263% increase between 2020 and 2025, and that it doesn’t expect that upward trend to “let up anytime soon.” In fact, submissions during the first three months of this year alone were nearly one-third higher than the same period last year.

Having handled some 42,000 instances in 2025, NIST has said that increased productivity is “not enough to keep up with growing submissions,” and confirmed it will now only focus on the most critical CVEs.

Beginning this week it plans to focus on an "enrichment list" – centralizing efforts around flaws found in software used within the federal government; any software systems deemed critical by the Biden-signed Executive Order on bolstering U.S. cybersecurity; and vulnerabilities appearing in the Cybersecurity and Infrastructure Security Agency's (CISA’s) Known Exploited Vulnerabilities (KEV) Catalog. Earlier this week, two new flaws were added to the list, with Microsoft Office and SharePoint products impacted.

NIST said it will no longer provide its own severity score for all submitted CVEs. Previously, the agency would offer up a scoring even if the CVE Numbering Authority had already provided a severity score, with the move meant to free up resources elsewhere.

The agency said such an approach will allow it to “stabilize the program while we develop the automated systems and workflow enhancements required for long-term sustainability.”

All submitted CVEs will still be added to the NVD. However, those that do not meet the criteria above will be categorized as "not scheduled," a NIST update reads.

“This will allow us to focus on CVEs with the greatest potential for widespread impact," NIST explained. “While CVEs that do not meet these criteria may have a significant impact on affected systems, they generally do not present the same level of systemic risk as those in the prioritized categories.”

RunSafe Security CTO Shane Fry in emailed comments to SDxCentral noted that the streamlined enrichment list will leave many CVEs on the table and “radically increase the difficulty for businesses and software developers to keep their software patched.”

“The announcement is a signal to the industry that the era of waiting for a CVE score before acting has come to an end,” Fry wrote. “Vulnerability visibility is imperfect, but organizations that use a diverse set of vulnerability data sources will have more reliable insight into vulnerabilities and which ones they are affected by. More importantly, organizations need to assume unknown vulnerabilities already exist in their software and deploy protections that can prevent exploitation before a patch – or a CVE score – is ever available."

Andrew Chipman, GRC manager at ProCircular, pointed out the increased workload facing NIST staffers, while U.S. Bureau of Labor Statistics shows system administrator jobs were being reduced.

“This highlights the lack of leaders who understand the growing need for dedicated maintenance teams,” Chipman said. “As NIST points out, the work they were doing to enrich vulnerability information may have been duplicative. Organizations should focus on fixing known exploited vulnerabilities first, critical vulnerabilities second, and everything else after that.”