The National Vulnerability Database (NVD), a cornerstone of U.S. cybersecurity infrastructure, has been rendered largely ineffective by internal mistakes at the National Institute of Standards and Technology (NIST), according to an inspector general report. The backlog of unprocessed security vulnerabilities mushroomed from 13,000 in February 2024 to more than 27,000 by the end of 2025.
The report says the growing deluge of unprocessed vulnerabilities is “undermining the NVD’s utility and public trust.” Without timely entries, security teams across the public and private sectors cannot rely on the database for awareness of newly discovered flaws, leaving systems exposed for longer periods.
The inspector general attributed the backlog to a combination of resource constraints, process inefficiencies, and management mistakes at NIST. The agency has struggled to keep pace with the rising volume of reported vulnerabilities, which has grown sharply in recent years.
NIST is now under pressure to clear the backlog and restore confidence in the NVD. The report does not specify a timeline for resolution, but officials are expected to outline remediation steps in response to the inspector general's findings.
No specific threat actor or active exploitation campaign is linked to the report. The issue is structural: a trusted vulnerability clearinghouse has fallen behind, creating information gaps that attackers could exploit. The NVD remains the government’s official repository for tracking known software flaws.