Skip to content

Reading NVD Records After The April 2026 Change

Integrations built on the NVD used to assume that every CVE would eventually carry an NVD severity score, a weakness classification and a list of affected products. On April 15, 2026, NIST moved to a risk-based model. Full analysis now goes only to CVEs in CISA's Known Exploited Vulnerabilities catalog, software the US federal government uses and software designated as critical under Executive Order 14028. Every other CVE still enters the database, often with no analysis to follow. Code that treats a missing score as a low score will misjudge risk without raising a single error.

Most tutorials skip the field that matters first.

Check vulnStatus Before Anything Else

vulnStatus shows where a record sits in NIST's workflow, and how far you can trust the rest of it. The values follow NIST's official status definitions.

Value What it means for your integration
Received Published to the CVE List and added to the NVD. NIST hasn't started its analysis.
Awaiting Analysis NIST has accepted the record for analysis but hasn't begun work on it.
Undergoing Analysis An NVD analyst is working on it, and fields may change within days.
Analyzed Analysis is complete. Severity scores, weakness data and affected-product data are attached.
Modified The record changed after analysis, so some NVD data may be revised.
Deferred NIST isn't prioritising the record, and its NVD fields may stay empty indefinitely. The NVD website now shows these records as "Not Scheduled", while the API still returns Deferred, so match on Deferred in code.
Rejected The CVE ID has been withdrawn. Remove it from your fix queue.

Since April 2026, non-priority records land in Deferred. The same status covers the older backlog of unanalysed CVEs published before March 1, 2026.

Two Records, Side By Side

Run both lookups and compare the responses.

curl "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2021-44228"
curl "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-6584"

CVE-2026-6584 is an authorization bypass in TransformerOptimus SuperAGI 0.0.14, an open-source framework for building autonomous AI agents. It was published in April 2026.

Field Log4Shell (CVE-2021-44228) SuperAGI (CVE-2026-6584)
vulnStatus Analyzed Deferred
NVD's own score (source is nvd@nist.gov, type is Primary) 10.0, CRITICAL None
CISA KEV fields (cisaExploitAdd) Present Absent

The SuperAGI record never says the flaw is harmless, only that NIST hasn't reviewed it. An integration that maps a missing NVD score to low priority will bury an authorization bypass in software that gives AI agents access to tools and data.

Deferred Records Can Slip Past Searches

NIST stores deferred CVEs in the NVD but leaves them out of default search results. A direct lookup by cveId still returns them, as the request above shows. Track the vulnerabilities your product depends on by ID, rather than relying on search to surface them.

Where Severity Comes From When NIST Hasn't Scored

Each entry under metrics carries a source and a type. A Primary entry from nvd@nist.gov is NIST's own assessment. Secondary entries come from other organisations, named in source by an email address or an ID. In the Log4Shell record, CISA supplied the secondary score under the ID 134c704f-9b21-4f2e-91b3-4a467353bcc0, the same ID that signs the record's SSVC data as CISA Coordinator.

Without a primary score, a secondary score from the CVE Numbering Authority or CISA is the best severity signal available. Store the source alongside the number. If NIST analyses the record later, your dashboards can then show why the score changed.

Building On Post-2026 Records

  • Read vulnStatus first and store it with every CVE you pull.
  • A missing NVD score means unknown risk, never low risk.
  • When no primary score exists, use the Secondary score and record its source.
  • Any CVE with cisaExploitAdd should rank above what its score alone suggests.
  • Track the CVEs in your own stack by ID, since search may hide deferred records.

Next Steps

Sources