NIST's New Prioritization Criteria for CVEs, Examined by Experts

"To me, this change represents a welcome transition from a Universal Vulnerability Library to a more refined Risk-Based Vulnerability Triage model."

"What NIST is acknowledging is something the research community has understood for years: you cannot centralize vulnerability triage at this volume and expect it to hold."

"The signal that actually drives remediation priority has always come from real-world exploitability, not database metadata, and that requires human researchers with adversarial instincts working continuously against live environments."

"This change will significantly impact solutions, specifically hardcoded tools, that provide a verdict based on the NVD's Common Platform Enumeration (CPE) strings."

NIST has announced changes to its handling of cybersecurity vulnerabilities in the National Vulnerability Database. The new approach will still list all CVEs but will only enrich those that meet specific prioritization criteria. This shift moves from a Universal Vulnerability Library to a Risk-Based Vulnerability Triage model. Experts emphasize that real-world exploitability should drive remediation priorities, rather than relying solely on database metadata. The changes will impact tools that depend on the NVD's Common Platform Enumeration strings, potentially leaving critical CVEs without necessary alerts.

Read at Securitymagazine