The catalog defenders rely on is two years behind, and an inspector general just put numbers on it.

The Commerce Department’s IG reported the National Vulnerability Database backlog grew from 13,000 unprocessed entries in February 2024 to more than 27,000 by the end of 2025. That’s the cybersecurity industry’s primary source of truth on what to patch. It’s also broken.

Attackers aren’t waiting for analyst enrichment. A new self-propagating npm worm called Miasma has hit Red Hat Cloud Services packages, stealing developer secrets and pivoting to CI/CD. DriveSurge has hijacked thousands of legitimate sites for ClickFix and FakeUpdate delivery. Neither campaign needs a CVE to do damage. And by the time NIST gets around to scoring the underlying issues, the access is already old news.

The Database Got Worse While Threats Got Faster

The NVD backlog is a measurement crisis for every patch program that uses CVSS scores and CWE tagging to decide what gets fixed this week.

If your monthly patch cycle gates on a critical CVSS score, you’re holding for a number an overworked analyst hasn’t assigned yet. The vulnerability exists in production code. The exploit exists in attacker hands. The score does not exist in your dashboard.

Vendor advisories still ship. CISA’s Known Exploited Vulnerabilities catalog still updates. EPSS still scores exploit probability. Teams that built their workflow around NVD enrichment as the source of truth have a stale source of truth.

The broader attack pattern doesn’t even fit the model. Miasma’s compromise gets no CVE because there’s no vulnerable software, just a malicious package version. The DriveSurge hijacks get no CVEs because they ride weak admin credentials and abandoned plugins. Threat detection that waits for a database entry will miss both classes entirely.

Stop Treating CVE Counts As Reality

Defense in depth was never supposed to mean “wait for the score.” The NVD problem makes that obvious.

The teams handling this well already moved their patching prioritization off NVD as the sole input. They blend EPSS for exploit likelihood, KEV for active exploitation evidence, and asset criticality from their own CMDB. Vendor advisories drive the timing now.

What this looks like in practice:

• Patch when the vendor says patch. Stop waiting for CVSS enrichment if the vendor already labeled it critical and exploit code is public.
• Subscribe directly to vendor security feeds. If the vendor publishes, your ticketing system should know within an hour.
• Treat KEV as your floor. Everything on it is overdue, and anything with public exploit code plus asset exposure should follow within days.
• Use exploitability data over theoretical scores. EPSS is imperfect, and it still moves faster than NVD.
• Map exposures to assets. A 9.8 CVE on an isolated test box has nothing in common with a 7.5 on your customer-facing edge.

None of this is novel. What’s changed is that the alternative, trusting the database, no longer works.

The Cybersecurity Controls That Don’t Need A CVE

The Miasma worm and the DriveSurge campaign share a useful property for defenders. Both are detectable without a single vulnerability identifier.

Behavioral telemetry catches the install-time credential harvesting from a malicious npm package. Egress filtering on build runners catches encrypted exfiltration to attacker infrastructure. Hash-pinned dependencies block the next typosquat before it lands. None of this requires a CVE to exist.

For the website hijacks, the controls are equally familiar. Brute-force protection on admin endpoints. MFA on every CMS panel. Inventory of installed plugins. Removal of anything unmaintained. Web application firewall rules that catch credential-stuffing volume even when the specific flaw has no documentation.

This is what security hardening looks like when you stop assuming the database knows what’s dangerous. You build controls that catch attacker behavior. Incident response playbooks should trigger on observed activity, never on a published vulnerability ID. Threat detection that requires a CVE to fire gets bypassed by every campaign that doesn’t have one yet.

Cyber security teams should be running a quarterly exercise around this. Pick a recent intrusion that has no clean CVE attached. Walk through what would have detected it. If the answer is “we’d have patched the CVE,” you have a gap.

The NVD will get fixed eventually. The IG report is the start of that pressure, not the end. The next six to twelve months will involve real defenders making real patch decisions with an unreliable database. Plan for that.

While you’re at it, take a hard look at what else in your program assumes the inputs are trustworthy. The firewall vendor’s threat intelligence feed. The EDR’s reputation scoring. The third-party CMDB. Anything that gets ingested without verification is a single point of failure waiting for an outage to expose it.

Sources

• Inspector general finds NIST mistakes have made vulnerability database ineffective
• Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm
• Hackers hijack thousands of sites for ClickFix and FakeUpdate attacks