ENISA Expands Its Role in the Global CVE Program
Summary
ENISA now oversees 20 CNAs under its CVE Root, including 12 onboarded directly and 8 transferred from MITRE Root, as it expands support for vulnerability identification and CVE record publication.
Key points
- ENISA reports 20 CNAs under its Root: 12 onboarded directly and 8 transferred from MITRE Root.
- ENISA became a CVE Root for European entities in November 2025.
- As a Root, ENISA recruits, trains, supports, and manages CNAs, and helps ensure CVE identifiers and records are assigned and published according to program rules.
- New participating organizations include CSIRTs, vendors and suppliers, international alliances, and security research organizations.
- ENISA says the expansion aims to broaden global participation and strengthen the CVE Program’s quality and operational capacity.
- ENISA and CISA representatives are scheduled to discuss the CVE Program’s evolution, priorities, and joint initiatives at Black Hat.
Article Details
- Event Type
- ENISA expanded its role in the CVE Program by onboarding and transferring CVE Numbering Authorities (CNAs) under the ENISA Root.
- Impact
- ENISA reports 20 CNAs under its Root: 12 onboarded directly by ENISA and 8 transferred from MITRE Root. The expanded role supports vulnerability identification and CVE record publication for European entities and contributes to the CVE Program’s global participation and operational capacity.
People
Hans de VriesENISA Chief Cybersecurity and Operations Officer; commented on the need to strengthen vulnerability management capabilities.Lindsey CerkovnikCISA Branch Chief for Vulnerability Response and Coordination; scheduled to discuss the CVE Program at Black Hat.Nuno Rodrigues CarvalhoENISA Head of Sector for Incident and Vulnerability Services; scheduled to discuss the CVE Program at Black Hat.