NIST Deprioritizes Pre-2018 CVEs Amid Backlog and New Threats

Article Highlights
Off On

The US National Institute of Standards and Technology (NIST) recently made a significant decision affecting the cybersecurity landscape by marking all Common Vulnerabilities and Exposures (CVEs) published before January 1, 2018, as “Deferred” in the National Vulnerability Database (NVD). This move impacts over 20,000 entries and potentially up to 100,000, signaling that these CVEs will no longer be prioritized for further enrichment data updates unless they appear in the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog. NIST’s decision comes in response to an ongoing struggle with a growing backlog in processing vulnerability data, exacerbated by a 32% surge in submissions in the past year.

An Overwhelming Backlog and Strategic Reprioritization

NIST’s challenges in processing and enriching the vast amount of incoming data have delayed its goal of clearing the backlog by the end of fiscal year 2024. In response, NIST is developing new systems to handle these issues more efficiently. Industry experts consider this move practical given the complexities of managing vulnerabilities at scale. Ken Dunham from Qualys describes it as an evolution in the face of changing cyber threats. Meanwhile, Jason Soroko from Sectigo interprets this as a strategic reprioritization, with resources redirected towards addressing emerging threats, assuming that legacy issues have been mitigated through routine patch management practices. The responsibility for managing deferred CVEs now shifts more heavily onto organizations. For security teams, this means identifying and monitoring legacy systems, prioritizing the patching of deferred vulnerabilities, and hardening or segmenting outdated infrastructure. Using real-time threat intelligence to detect attempts at exploiting these vulnerabilities becomes crucial. This shift highlights a broader trend where organizations must adopt proactive risk management strategies due to the increasing volume of CVEs and limited resources available to handle them.

Embracing Advanced Technology for Improved Efficiency

In addressing its backlog, NIST is also exploring the potential use of artificial intelligence (AI) and machine learning to streamline the processing of vulnerability data. This move reflects an ongoing trend in the cybersecurity industry toward leveraging advanced technologies for more efficient management of vulnerabilities. By incorporating AI and machine learning, NIST aims to ensure that both older and newer vulnerabilities receive appropriate attention within the constraints of available resources. This nuanced approach to cybersecurity management underscores the need for a balance between addressing legacy vulnerabilities and staying ahead of emerging threats. Organizations are encouraged to adopt similar strategies, using technology to enhance their cybersecurity efforts and ensure comprehensive coverage of potential vulnerabilities. This shift in focus not only addresses immediate backlog issues but also sets the stage for more sustainable and scalable vulnerability management practices in the future.

New Paradigm for Cybersecurity Management

The US National Institute of Standards and Technology (NIST) has recently made a crucial decision that impacts the cybersecurity domain by designating all Common Vulnerabilities and Exposures (CVEs) published before January 1, 2018, as “Deferred” in the National Vulnerability Database (NVD). This adjustment affects over 20,000 entries and potentially up to 100,000, indicating that these CVEs will no longer receive prioritized updates for enrichment data unless they are listed in the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog. NIST’s decision is a response to an ongoing challenge with a growing accumulation of vulnerability data, which has been aggravated by a 32% increase in submissions over the past year. This strategic shift aims to address the backlog more effectively and allocate resources more efficiently, ensuring newer and more critical vulnerabilities receive the attention they require for maintaining robust cybersecurity measures.

Explore more

Trend Analysis: Labor Market Slowdown in 2025

Unveiling a Troubling Economic Shift In a stark revelation that has sent ripples through economic circles, the July jobs report from the Bureau of Labor Statistics disclosed a mere 73,000 jobs added to the U.S. economy, marking the lowest monthly gain in over two years, and raising immediate concerns about the sustainability of post-pandemic recovery. This figure stands in sharp

How Is the FBI Tackling The Com’s Criminal Network?

I’m thrilled to sit down with Dominic Jainy, an IT professional whose deep expertise in artificial intelligence, machine learning, and blockchain gives him a unique perspective on the evolving landscape of cybercrime. Today, we’re diving into the alarming revelations from the FBI about The Com, a dangerous online criminal network also known as The Community. Our conversation explores the structure

How Is OpenDialog AI Transforming Insurance with Guidewire?

In an era where digital transformation is reshaping industries at an unprecedented pace, the insurance sector faces mounting pressure to improve customer experiences, streamline operations, and boost conversion rates in a highly competitive market. Insurers often grapple with challenges like low online sales, missed opportunities for upselling, and inefficient customer service processes that frustrate policyholders and strain budgets. Enter a

How Does Hitachi Vantara Enhance Hybrid Cloud Management?

In an era where businesses are increasingly navigating the complexities of digital transformation, the challenge of managing data across diverse environments has become a pressing concern for IT leaders worldwide. With a significant number of organizations adopting hybrid cloud architectures to balance flexibility and control, the need for seamless integration and robust management solutions has never been more critical. Hitachi

Zurich’s Agentic AI Challenge Revolutionizes Insurance Innovation

What if the insurance industry, long rooted in tradition, could be transformed overnight by the collective brilliance of over 1,000 minds from across the globe, creating a world where claims are processed in hours, not days, and risk assessments are tailored with pinpoint accuracy, all thanks to cutting-edge technology? Zurich Insurance Group has turned this vision into reality with a