NIST Seeks Public Input for Modernizing National Vulnerability Database
62-day public comment period begins to reshape vulnerability management for the AI era.
1Public Comment Period for NVD Modernization
NIST has launched a 62-day public comment period to modernize the National Vulnerability Database (NVD) for the AI era. Running from August 12 to October 13, 2026, the request for information published in the Federal Register seeks input on NVD's scalability, automation, interoperability, and AI's role in vulnerability management. The NVD serves as the U.S. government's primary vulnerability database, enriching CVE records with severity scores and affected product details within about an hour of publication.
2NVD's Current Function and Significance
Operated by NIST's Information Technology Laboratory, the NVD ingests records from the Common Vulnerabilities and Exposures (CVE) program, enhancing them with severity scores and affected product information. Consumed by security tools via web interfaces and APIs, this data forms the foundation for software security, compliance automation, and cybersecurity risk analysis. The database is widely used across both public and private sectors for vulnerability management and threat assessment.
3AI Threats and NIST's Modernization Goals
NIST warns that traditional vulnerability management approaches are becoming inadequate in an ecosystem shaped by AI-powered cyber tools and accelerated delivery cycles. Malicious actors could potentially use AI systems to discover and exploit vulnerabilities at unprecedented scale. NIST aims to create a 'continuous, contextual, and automated' vulnerability management ecosystem. The modernization effort will redefine AI's role throughout the vulnerability lifecycle while maintaining necessary human oversight.
4Key Questions in the Comment Process
The RFI poses questions across seven critical areas. It examines where AI automation should be applied in the vulnerability lifecycle and which tasks should remain under human review. For risk assessment, it queries how contextual prioritization should function and how to enhance transparency in AI-driven decisions. Regarding remediation, it investigates AI's potential role in generating fixes, safeguards against erroneous AI-generated remediations, and barriers preventing organizations from timely patching.
5Data Structures and Future Vision
Two sections of the RFI address foundational issues beyond daily operations. It questions whether current identifiers, product naming schemes, and severity scoring systems remain adequate for AI-era prioritization. The notice seeks to identify gaps in machine-readable vulnerability data. Respondents are asked to define NVD's future capabilities, anticipate emerging trends it should address, and propose metrics to measure modernization success over the next five years.
6Current Challenges and Triage Model
NIST acknowledged in April 2026 that it could no longer handle the database's core workload. CVE submissions increased 263% between 2020-2025, with 2026's first quarter seeing a 33% year-over-year rise. Despite enriching 42,000 CVEs in 2025 (45% more than any previous year), backlogs persisted. NIST implemented a triage model prioritizing CVEs affecting federal government software and critical infrastructure (processed within one business day), while labeling others as 'Lowest Priority - not scheduled for immediate enrichment.'
7Recent Improvements to Data Feeds
On June 17, 2026, NVD expanded its data feeds and APIs to incorporate CISA's Stakeholder-Specific Vulnerability Categorization data alongside existing severity scores. This update affected approximately 95% of vulnerabilities in the database. NIST warned API users to expect larger payloads and increased latency during the refresh period. The modernization effort continues to focus on architectural decisions, standards development, and data governance improvements informed by public feedback.
8Process Significance and Expected Outcomes
The comment period will directly inform NVD's strategic planning, technical architecture decisions, and standards development. For security teams, questions about prioritization criteria, machine-readable data, and scoring standards will most impact future workflows. NIST specifically encourages submission of unpublished studies and empirical data, signaling its preference for evidence-based input over position statements. All comments must be submitted electronically by October 13, 2026, through regulations.gov under docket NIST-2026-0100.