Originally published on satyamrastogi.com
NIST's decision to deprioritize enrichment for non-CISA KEV CVEs creates a two-tier vulnerability landscape. Attackers now weaponize untracked CVEs before defenders even catalog them.
NVD Enrichment Triage: Attacker's Advantage in Unpatched CVE Gaps
Executive Summary
NIST's announcement to selectively enrich National Vulnerability Database entries fundamentally shifts threat landscape visibility. By deprioritizing CVEs outside CISA's Known Exploited Vulnerabilities catalog and critical software lists, a shadow inventory of exploitable flaws emerges. From an offensive perspective, this is operational gold.
We're entering a vulnerability triage economy where defenders get partial intelligence, but attackers operate with full sight. The gap between what gets tracked and what gets exploited is widening, and the smart money is on weaponizing the untracked surface.
Attack Vector Analysis
This policy creates three immediate attack vectors:
1. Pre-Intelligence Exploitation Windows
Vulnerabilities in non-critical software (by NIST/CISA standards) may never receive detailed enrichment. This means:
- Exploitation can proceed without NVD baseline data enrichment
- CVSS scores, attack vectors, and impact assessments remain sparse or missing
- Defenders lack centralized reference material for risk prioritization
- Attackers exploit the gap between CVE publication and enrichment timeline
This maps to MITRE ATT&CK T1566 (Phishing) and T1195 (Supply Chain Compromise) chains where secondary/tertiary software becomes the entry point. Historically, we've seen this with EssentialPlugin's WordPress supply chain compromise, where less-scrutinized plugins became the attack surface.
2. CVSS Inversion Attacks
Without standardized NVD enrichment, organizations apply inconsistent severity ratings. A vulnerability rated low by one org, medium by another, creates prioritization chaos. Attackers scan networks for systems where this CVE is deemed "low-risk" and goes unpatched.
The practical attack: distribute exploits for CVEs CISA hasn't listed as known exploited. Even if patched exist, the lack of enrichment means no centralized scoring system forces urgency.
3. Supply Chain Targeting via Untracked Dependencies
Think about software Bill of Materials (SBOM) dependencies. Components used by critical software may themselves have CVEs that won't be enriched because the component isn't on CISA's critical list. We weaponize the transitive dependency.
Example: A logging library used by healthcare software has a RCE. Library isn't "critical software" by NIST's criteria. No enrichment priority. But it's in the supply chain of critical software. Mirax RAT and similar campaigns have exploited this exact gap by targeting software components rather than flagship applications.
Technical Deep Dive
NVD Enrichment Data Structure
NIST's enrichment process typically includes:
{
"cve_id": "CVE-2026-XXXXX",
"base_score": 9.8,
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "NETWORK",
"affected_cpe_list": [
"cpe:2.3:a:vendor:product:version:*:*:*:*:*:*:*"
],
"references": [
{"url": "https://vendor.com/advisory", "source": "VENDOR"}
],
"weaknesses": ["CWE-94", "CWE-78"],
"configurations": [
{"vulnerable": true, "cpe": "cpe:2.3:a:..."}
]
}
When NVD doesn't enrich, this data remains:
- Sparse (only NVD ID and publication date)
- Incomplete (no CVSS, no attack vector clarity)
- Unlinked (no CPE mappings to your inventory)
Defenders can't pivot on this data. Attackers can exploit unstructured vulnerability information faster than defenders can structure responses.
The Enrichment Gap Timeline
Historically, NVD enrichment averages 1-3 days after CVE publication. Under selective enrichment:
CVE Published: Day 0
|
+-- CISA KEV candidate: Enrich (24-48h)
|
+-- Critical software vendor: Enrich (24-48h)
|
+-- Other CVE: Queue in backlog (30+ days or never)
Attackers operate in the backlog window. Exploit-db drops PoC code, Shodan-based scanning identifies vulnerable instances, and lateral movement chains form before defenders even get CVSS scores.
Real-World Exploitation Pattern
From red team campaigns, we've observed attackers using this exact gap:
- Monitor CVE feeds for publication (not enrichment)
- Parse initial advisory for attack vector hints
- Scan for vulnerable instances before NVD enrichment makes it "official"
- Deploy exploit chains targeting non-critical software components
- Pivot to critical systems through dependency relationships
This pattern accelerated during the April 2026 threat surge, where SharePoint zero-days and Excel RCEs exploited the intelligence lag.
Detection Strategies
1. Non-NVD CVE Enrichment (Blue Team Hardening)
Don't wait for NIST enrichment. Deploy continuous CVE parsing from:
- Vendor advisories (RSS feeds, security mailing lists)
- GitHub security advisories
- NVD raw API (before enrichment metadata)
- MITRE ATT&CK repository for attack pattern context
Build internal CVE enrichment pipelines that assign risk scores independently of NIST triage decisions.
2. Dependency Chain Mapping
Map all transitive dependencies in your supply chain:
# Example: npm audit with depth
npm audit --json | jq '.vulnerabilities[] | select(.severity != "info")'
# SBOM generation (CycloneDX format)
cdx-npm --output-format json myapp/
# Cross-reference against internal CVE database
Identify components that won't receive NVD enrichment priority but exist in critical software supply chains.
3. Behavioral Anomaly Detection
Monitor for exploitation patterns:
- Unusual process creation from non-critical software (unpatched CVE exploitation)
- Network connections to external IPs immediately after software execution
- File system operations suggesting lateral movement from non-critical component
Alerts should fire on activity matching MITRE T1566 and T1195 even if the source CVE isn't NVD-enriched.
4. Threat Intel Fusion
Enrich missing NVD data with:
- GreyNoise data (commodity vs targeted exploitation)
- Shodan query results for exposed vulnerable software
- Dark web chatter on underground forums
- Malware sandboxing results showing exploitation techniques
Mitigation and Hardening
Immediate Actions
CVE-to-Inventory Matching Automation: Build a system that catches CVEs before NVD enrichment marks them "official". Use raw CVE feeds and parse vendor advisories programmatically.
Dependency Auditing at Deploy Time: Every deployment should trigger automatic transitive dependency scanning against all known CVEs (not just NVD-enriched ones). Container registries should block images with unpatched secondary components.
-
Risk Scoring Independence: Stop relying solely on CVSS scores from NVD. Assign your own risk matrix based on:
- Whether the component is in your attack surface
- Exploitability (proof-of-concept availability, weaponization ease)
- Business context (does this software touch sensitive data?)
Patch Priority Recalibration: With NVD enrichment delayed, you must move from "patch when scored critical" to "patch when detected in your inventory, regardless of score". This is a cultural shift for most organizations.
Long-Term Hardening
Dependency Minimization: Reduce software footprint. Every dependency is a CVE ticking bomb. If a non-critical component isn't essential, remove it. This directly counters supply chain attacks.
Segmentation by Software Tier: Isolate non-critical software from critical systems. If a logging library gets compromised, it shouldn't grant access to healthcare data or financial systems.
Exploit Prediction Modeling: Use historical CVE data to predict which untracked vulnerabilities are likely to become weaponized. Software with poor security track records, large user bases, and complex attack surfaces should be treated as higher-risk even without NVD enrichment.
Threat Hunting for Untracked CVEs: Assume your organization has been compromised via untracked CVEs. Hunt for behavioral indicators that match known exploitation techniques for recent non-enriched vulnerabilities.
Key Takeaways
NVD enrichment delays create an intelligence asymmetry: Attackers move faster than defenders can catalog threats when triage occurs at NIST rather than in real-time at organizational level.
Supply chain becomes primary attack surface: Software that isn't "critical" by NIST standards but exists in critical software dependencies becomes the preferred pivot point.
Patch windows collapse: Without centralized enrichment urgency, defenders lose the forcing function that drives timely patching. Attackers weaponize the delay.
Dependency management is now a security-critical function: Your SBOM and transitive dependency mapping must be as rigorous as your perimeter security.
Internal CVE enrichment is mandatory: Organizations can no longer delegate vulnerability intelligence to NVD. Build competitive intelligence on untracked CVEs or face gap exploitation.
Conclusion
NIST's pragmatic decision to deprioritize enrichment for non-critical software solves an internal problem: CVE volume management. But it creates an external problem for defenders: a two-tier vulnerability landscape where visibility is selective.
From a red team perspective, this is the environment we've been waiting for. Attackers now have implicit permission to exploit untracked CVEs while defenders struggle with prioritization in a fragmented threat landscape.
The organizations that survive this shift will be those that build independent CVE enrichment pipelines, treat supply chain dependencies as critical infrastructure, and patch based on presence in their environment rather than waiting for NIST's official scoring. Everyone else becomes another statistic in a supply chain breach.
