Das US-amerikanische #NIST gibt einen zentralen Teil seiner Arbeit auf: Die unabhängige Bewertung von IT-#Sicherheitslücken nach dem #CVSS-Standard soll künftig weitgehend entfallen und den Herstellern überlassen werden - die dies erfahrungsgemäß herunterspielen.

Hintergrund ist ein massiver Bearbeitungsrückstau in der #Schwachstellendatenbank #NVD, weil das Budget seit Jahren nicht mehr mit der wachsenden Zahl gemeldeter Schwachstellen Schritt hält:

https://www.oig.doc.gov/wp-content/OIGPublications/OIG-26-020-I-SECURED.pdf #cybersecurity

Resulting from funding gaps and idiotic shifts in priorities the U.S.A. is now woefully under investing in our core CyberDefense Ecosystem....

National Institute of Standards and Technology (NIST) is no longer enhancing all Common Vulnerabilities and Exposures (CVEs) with analysis and severity indicators, and instead NIST will prioritize enriching a much narrower set of security vulnerabilities.

Related: In April 2025, a funding gap by in DHS appropriations threatened to cease CVE operations entirely —which would have creating systemic risk for global vulnerability management. An emergency funding extension was implemented to avoid a full on crisis. https://www.justsecurity.org/136914/nist-cant-keep-up/ #NIST #MITRE #CVEs #NVD #Security #Risk #CyberSecurity #CyberDefence #CyberInfrastructure #AI #AISecurity #CISA #DHS #Vulnerability #ThreatIntelligence

NIST changes NVD rules, 160+ MSFT patches, and a new 'Comment and Control' attack targeting AI agents. #CyberSecurity #NVD #NIST #PatchTuesday #AISecurity 🧵👇

https://hackwithheart.com/paper-trail/the-end-of-enrichment-nist-pivots-as-vulnerability-volume-soars?utm_source=mastodon&utm_medium=jetpack_social

NIST has confirmed a major policy shift, drastically reducing its CVE enrichment efforts and focusing only on critical vulnerabilities like those in CISA's KEV catalog. This move, driven by an overwhelming backlog and budget cuts, means security teams can no longer depend on the NVD as a single source of truth, forcing a re-evaluation of vulnerability management strategies and skepticism towards…

https://www.tpp.blog/1f95u2a

#cybersecurity #nist #nvd

🤖 This post was AI-generated.

NIST Curtails CVE Enrichment Amid Vulnerability Surge

The National Institute of Standards and Technology (NIST) is overhauling its approach to enriching entries in the National Vulnerability Database (NVD) due to a staggering 263% surge in vulnerability submissions. To keep pace, NIST will now prioritize enrichment for only the most critical entries that meet specific conditions.

https://osintsights.com/nist-curtails-cve-enrichment-amid-vulnerability-surge?utm_source=mastodon&utm_medium=social

#VulnerabilityManagement #Nist #NationalVulnerabilityDatabase #Nvd #Cve