Since February 2024, the National Institute of Standards and Technology’s (NIST) National Vulnerability Database (NVD) has encountered delays in processing vulnerabilities. This backlog, caused by factors such as software proliferation, budget cuts and changes in support, has significant implications for managed service providers (MSPs).

NIST, an agency within the United States Commerce Department, saw its budget cut by nearly 12% this year. For over 20 years, the NVD has been a critical resource for cybersecurity experts, providing essential information such as severity scores, reference tags and vulnerability classifications. The increasing number of disclosed vulnerabilities, reaching 28,961 common vulnerabilities and exposures (CVEs) in the past year, underscores the challenges in software vulnerability management.