As part of the transition filed at 26-0412, approximately 29,000 backlog CVEs were reclassified as "Not Scheduled" — a status indicating that enrichment is not planned.
It is an honest administrative act, and it creates a specific problem downstream.
Absence Of Data Is Not Absence Of Risk
Most vulnerability tooling was built on an implicit assumption: an entry either has analysis, or is waiting for it. "Waiting" is temporary and tools handle it by rechecking later.
"Not scheduled" is permanent, and it is semantically different from both an enriched entry and a pending one. A tool that treats it as pending will recheck forever. A tool that treats it as absent will drop it. Neither behaviour surfaces it to a human as something requiring a decision.
The Metrics Will Look Better
Consider what happens to a vulnerability management dashboard. Unscored entries do not appear in critical counts. Remediation coverage, measured against scored vulnerabilities, improves.
The organisation’s reported posture strengthens because 29,000 entries left the denominator. Nothing about its actual exposure changed, and the number that improved is the one reported to a board.
What To Do About It
Ask a narrow question of whoever owns vulnerability management: how does our tooling represent a "not scheduled" CVE, and can we produce a list of ones affecting software we run?
If the answer is that nobody has checked, that is the finding. It is a half-day of work and it is more valuable than most threat intelligence an organisation will buy this year.
Compiled from published analysis of the NVD transition, listed below. The reclassification count is as reported. The downstream tooling analysis is ours and labelled as such. Corrections: corrections@forensicpost.com.