# NIST announces changes to CVE prioritization that reduces scope

**URL:** <https://discuss.rapid7.com/t/nist-announces-changes-to-cve-prioritization-that-reduces-scope/57172>\
**Category:** InsightVM\
**Tags:** InsightVM, vulnerability-management\
**Created:** [April 17, 2026, 2:21pm UTC](https://discuss.rapid7.com/t/nist-announces-changes-to-cve-prioritization-that-reduces-scope/57172 "2026-04-17T14:21:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![john\_woodling](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/j/3d9bf3/32.png) [@john\_woodling](https://discuss.rapid7.com/u/john_woodling)\
**Post date:** [April 17, 2026, 2:21pm UTC](https://discuss.rapid7.com/t/nist-announces-changes-to-cve-prioritization-that-reduces-scope/57172/1 "2026-04-17T14:21:54Z")

</div>

I was hoping to get a blurb or something from Rapid7 about the recent changes announced by NIST earlier this week. I am curious how Rapid7 plans to tackle that either individually, with the vulnerability management consortium (alliance, whatever its called), and so on.

[NIST Updates NVD Operations to Address Record CVE Growth | NIST](https://www.nist.gov/news-events/news/2026/04/nist-updates-nvd-operations-address-record-cve-growth)

Criteria from article:  
**New Prioritization Criteria**  
Starting on April 15, 2026, we will prioritize the following CVEs for enrichment:

- CVEs appearing in [CISA’s Known Exploited Vulnerabilities (KEV) Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

- CVEs for software used within the federal government

- CVEs for [critical software](https://www.nist.gov/document/definition-critical-software-under-executive-order-eo-14028 "Definition of Critical Software Under Executive Order (EO) 14028") as defined by Executive Order 14028

---

<div class="post-metadata">

**Author:** ![bradpjaxx](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/bradpjaxx/32/2411_2.png) [@bradpjaxx](https://discuss.rapid7.com/u/bradpjaxx)\
**Post date:** [April 20, 2026, 7:56pm UTC](https://discuss.rapid7.com/t/nist-announces-changes-to-cve-prioritization-that-reduces-scope/57172/2 "2026-04-20T19:56:28Z")

</div>

i haven't seen anything come out From R7 yet on these changes or alignment.

going to be interesting to see/hear there take on this and how this will be handled.