NIST Defers Over , Vulnerabilities in the National Vulnerability Database: A Strategic Shift in Cybersecurity Prioritization

In a significant move, the US National Institute of Standards and Technology (NIST) has announced that all Common Vulnerabilities and Exposures (CVEs) published before January 1, 2018, will be marked as “Deferred” in the National Vulnerability Database (NVD). This decision comes as part of the agency’s response to a growing backlog of vulnerability data and the increasing demand for timely cybersecurity threat management. The shift marks a pivotal moment in how legacy vulnerabilities are handled, potentially affecting over 100,000 CVEs.

the

NIST has confirmed that it will mark all CVEs published before January 1, 2018, as “Deferred” in the National Vulnerability Database (NVD). These vulnerabilities will no longer be prioritized for data enrichment updates unless they appear in the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog. To make this change visible, banners will be added to the affected CVE pages.

This shift has already impacted over 20,000 CVE entries, and it is anticipated that up to 100,000 CVEs could be affected by this decision. The move is being driven by a significant backlog in processing vulnerability data, with a 32% surge in submissions last year alone. NIST failed to meet its goal of clearing this backlog by the end of fiscal year 2024, due in part to difficulties in efficiently importing and enriching incoming data.

NIST has been actively working on new systems to process vulnerability data more efficiently. The decision to defer older vulnerabilities is seen by experts as a strategic move to reallocate resources to more urgent, emerging cybersecurity threats. With this change, the responsibility for managing older vulnerabilities has shifted more directly to organizations themselves, with security teams advised to monitor legacy systems, prioritize patching deferred vulnerabilities, harden outdated infrastructure, and use real-time threat intelligence.

What Undercode Say:

From a cybersecurity perspective, NIST’s decision to defer CVEs published before 2018 signifies a major shift in how vulnerabilities are prioritized and handled. This change is largely a result of the overwhelming volume of incoming vulnerability data, which has created an unmanageable backlog. With thousands of new vulnerabilities being reported annually, NIST and other cybersecurity agencies must make difficult decisions about where to allocate their limited resources.

Ken Dunham, Cyber Threat Director at Qualys, emphasizes that this move is a natural progression in the evolution of vulnerability management. With so many vulnerabilities now documented and mitigated, the focus needs to shift toward emerging threats that pose a more immediate risk to organizations. Similarly, Jason Soroko, Senior Fellow at Sectigo, views this decision as a strategic reprioritization, reallocating resources toward the most urgent issues rather than focusing on older vulnerabilities that are assumed to be well-managed.

However, the move comes with a caveat. Although older CVEs will no longer be a priority for NIST in terms of enrichment data, they will remain accessible, and metadata updates can still be requested. This means that organizations must take a more proactive role in managing these older vulnerabilities, ensuring they are properly patched and mitigated. The onus is now on individual organizations to monitor and secure their legacy systems, which may no longer receive the same level of attention from the central databases.

This shift is not without its challenges. Security teams now need to closely evaluate their legacy infrastructure and make decisions about how best to secure older systems that may still be in use. The advice to prioritize patching deferred vulnerabilities where feasible is essential, as unpatched legacy systems remain a prime target for cybercriminals. Additionally, hardening or segmenting outdated infrastructure and using real-time threat intelligence to detect exploitation attempts can significantly reduce the risk posed by these deferred vulnerabilities.

NIST’s efforts to streamline the processing of vulnerability data with the help of AI and machine learning will also play a crucial role in addressing the growing threat landscape. Automation could help ease the burden of processing and updating CVE data, making it easier for cybersecurity professionals to focus on more immediate threats while ensuring legacy vulnerabilities don’t get neglected.

In the broader context of cybersecurity, this decision reflects the growing complexity of managing vulnerabilities in an era of rapid technological change. As the volume of CVEs continues to increase, the role of AI, machine learning, and automation in vulnerability management will only grow. However, this also underscores the critical need for organizations to take ownership of their own security, ensuring that they are not overly reliant on central agencies for threat mitigation.

Fact Checker Results:

NIST’s decision to defer older CVEs appears to be driven by the overwhelming backlog of data and the necessity to allocate resources toward more immediate threats.
The move reflects a shift from centralized vulnerability management to a more distributed approach, where organizations take on a more active role in securing older systems.
While older CVEs will no longer be prioritized for enrichment data, they will remain accessible, and updates can still be requested, ensuring that organizations can stay informed.