The Enrichment Gap: A Longitudinal Audit of the NVD Backlog and Its Propagation Through Downstream Vulnerability Feeds

Abstract

Background: On 12 February 2024, the U.S. National Vulnerability Database slowed its enrichment of new CVE records, creating a backlog that grew past 18,000 unanalyzed vulnerabilities — at its peak, 93.4% of new CVEs went unanalyzed, and even 46.7% of CISA's Known Exploited Vulnerabilities added in that window waited months for analysis. Recovery reached pre-slowdown processing rates by March 2025, and NVD enriched approximately 42,000 CVEs in 2025 (+45% over any prior year), but CVE submissions grew 263% between 2020 and 2025, and in April 2026 NIST formally moved unenriched pre-March-2026 records to a "Not Scheduled" category, adopting prioritized enrichment (KEV-first within one business day). Objective: We audit the full 2024–2026 backlog record and analyze how the enrichment gap propagates through the downstream vulnerability ecosystem. Methods: Longitudinal documentary analysis of NIST/NVD operational announcements, third-party backlog measurements (VulnCheck), and the downstream data architecture (CVE List → NVD → ADP layer → consumer feeds); construction of a backlog-risk register. Results: The backlog's severity was concentrated in exactly the fields that downstream tools consume — CPE applicability, CWE classification, and NVD-CVSS scores — breaking asset matching, triage, and compliance scanning for the unenriched window. The community-layer response (CISA's ADP Vulnrichment from July 2024) demonstrated that parallel enrichment is feasible but arrived with coverage and quality variance. The 2026 prioritization policy converts a temporary gap into a permanent two-tier record. Conclusions: The enrichment gap is structural, not episodic: a triage-first enrichment policy plus 263% submission growth means the unenriched tier will persist and grow. Downstream consumers must diversify their enrichment inputs (ADP feeds, EPSS, exploit signals) and stop treating NVD CPE data as the sole asset-matching mechanism.