NIST Vows to Tackle NVD CVE Backlog

Understanding the CVE Backlog at NIST NVD

The National Institute of Standards and Technology (NIST) recently addressed the significant backlog of Common Vulnerabilities and Exposures (CVEs) awaiting processing in the National Vulnerability Database (NVD). As of February 2024, NIST has struggled to maintain its usual processing rates, leading to concerns about cybersecurity and the potential exploitation of unprocessed vulnerabilities.

Current State of the Backlog

On May 29, 2024, NIST announced the award of a contract for additional processing support to manage the influx of CVEs. This support aims to restore the processing rates observed prior to February within the next few months. The backlog developed post-February is being tackled with assistance from the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA), and it is anticipated to be cleared by the end of the fiscal year.

Implications of the Backlog

The slowdown in processing CVEs has had significant ramifications. Since February 12, 2024, 12,720 new vulnerabilities have been added to the NVD, but 11,885 of these have not been analyzed or enriched. This lack of analysis means critical data—such as the software affected by these vulnerabilities—remains unavailable. The delay poses serious risks, as unprocessed vulnerabilities provide opportunities for malicious actors to exploit them, increasing supply chain risks across critical sectors.

Industry Concerns and Key Findings

Prominent voices in the cybersecurity industry have expressed concerns over this situation. A study by VulnCheck highlights the severity of the backlog:

• 93.4% of new vulnerabilities remain unanalyzed since February 12, 2024.
• 50.8% of Known Exploited Vulnerabilities (KEVs) have not been analyzed.
• 55.9% of Weaponized Vulnerabilities remain unanalyzed.
• 82% of CVEs with Proof-of-Concept Exploits are unanalyzed.

These statistics underscore the potential danger as unanalyzed vulnerabilities could be weaponized by threat actors, leading to more frequent and severe cyberattacks.

NIST’s Role and Future Plans

For over two decades, NIST's NVD has been a cornerstone of global cybersecurity, providing enriched vulnerability data that organizations rely on for software security. Despite the current backlog, NIST remains committed to its mission. The organization is working on long-term solutions, including technological and process improvements to handle the increasing volume of vulnerabilities.

NIST's goals are to build a sustainable program supporting the automation of vulnerability management, security measurement, and compliance. With a 25-year history of managing the NVD, NIST is uniquely positioned to maintain and modernize this critical resource, ensuring it continues to foster trust in information technology and innovation.

Moving Forward

To address the current backlog and future challenges, the CVE community, including CVE Numbering Authorities (CNAs), should collaborate closely. CNAs can help by providing more comprehensive data when publishing new CVEs. This includes detailed product names, vendor information, version numbers, and other relevant details.

NIST and CVE.org/MITRE should focus on automating CVE enrichment and consider accelerating the Authorized Data Provider (ADP) program to incorporate third-party contributions. Initiatives like CISA’s Vulnrichment project and the CISA KEV catalog can play a crucial role in this effort.

Conclusion

The backlog at NIST's NVD is a significant issue that the organization is actively addressing. Through increased support, collaboration with CISA, and future technological advancements, NIST aims to overcome the current challenges and continue to provide a robust, reliable, and comprehensive vulnerability database essential for global cybersecurity. Keeping the community informed of progress and modernization plans will be key to maintaining trust and fostering innovation in the field of information technology.