Loading story…
ENISA announced that the NATO Cyber Security Centre and AI startup AISLE have become CVE Numbering Authorities under the ENISA Root, giving them the ability to assign CVE identifiers to disclosed software vulnerabilities. NATO’s authority covers eligible flaws across the NATO enterprise, while AISLE is limited to vulnerabilities discovered in its own products. The move expands the organizations able to name and track vulnerabilities and adds to ENISA’s growing role in the CVE ecosystem.
The designation comes amid broader changes in vulnerability management after continuity and governance concerns around the CVE program in 2025 and as AI speeds up vulnerability discovery. ENISA now oversees 20 numbering authorities under its root, including organizations added directly and others transitioned from the MITRE Root, while parallel initiatives such as CIRCL’s Global CVE Allocation System (GCVE) highlight a wider push to diversify how software flaws are cataloged and tracked.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
Earlier in 2026, CIRCL launched the Global CVE Allocation System (GCVE) as an alternative vulnerability-tracking initiative to the CVE program.
The CVE program narrowly avoided shutdown in April 2025 when its contract received a last-minute 11-month extension, preserving continuity for the vulnerability identification system.
ENISA announced that the NATO Cyber Security Centre and AISLE became CVE Numbering Authorities under the ENISA Root. The move expanded the organizations able to assign CVE identifiers, with NATO covering eligible flaws across the NATO enterprise and AISLE covering vulnerabilities in its own products.
ENISA became a CVE Root for European entities, taking on responsibility for recruiting, onboarding, supporting, and managing CVE Numbering Authorities within its scope in coordination with CISA and MITRE.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
cyberscoop.com
Open sourcegcve.eu
Open sourceenisa.europa.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The European Union Agency for Cybersecurity (ENISA) has been elevated to a "Root"-level participant in the Common Vulnerabilities and Exposures (CVE) program, granting it the authority to assign CVE identifiers and publish CVE records. This new role positions ENISA as a central coordinator for vulnerability disclosures across the European Union, aiming to reduce fragmentation, strengthen cross-border coordination, and accelerate responsible disclosure processes. ENISA will also serve as a primary contact point for vulnerabilities reported by or to the European Union Computer Security Incident Response Teams (CSIRTs). This development is part of broader EU efforts to enhance cybersecurity, including the launch of the European Union Vulnerability Database as a counterpart to the U.S. National Vulnerability Database. ENISA is also developing a "Single Reporting Platform" for manufacturers to disclose actively exploited vulnerabilities, a requirement that will become mandatory under the Cyber Resilience Act starting in 2026. These initiatives are expected to improve the EU's ability to manage and coordinate cybersecurity vulnerabilities and bolster digital security across the union.
Jun 29, 2026
The CVE Program approved updated **CVE Numbering Authority (CNA) Rules** that broaden how vulnerabilities can be assigned identifiers and clarify which CNA should handle a report. The revised framework introduces a **right-of-first-refusal** model that favors the CNA with the most appropriate scope, adopts more **technology-neutral** criteria for deciding whether an issue merits a `CVE`, and adds clearer guidance on what types of findings do and do not qualify for assignment. The changes are expected to affect vulnerability management by increasing flexibility for CNAs and potentially expanding coverage to issues that previously sat in gray areas, including some **cloud misconfigurations** and certain **supply-chain compromises**. The updated guidance still leaves open questions around shared code, protocols, specifications, and upstream dependencies, with examples such as **HTTP/2 CONTINUATION Flood** and **HTTP/2 Rapid Reset** illustrating the continuing ambiguity over how broadly CVEs should be assigned.
Jul 24, 2026
European Union officials said they want to help strengthen and modernize the **Common Vulnerabilities and Exposures (CVE) Program** after a 2025 contracting scare involving MITRE raised concerns about the long-term resilience of a system widely used to track and identify software flaws. ENISA cybersecurity official Hans de Vries said EU member states asked the agency to examine how to reinforce the process, arguing that such a critical global mechanism should not rely on a single U.S. government contract, while U.S. policymakers are weighing legislation that could formalize the program and expand **CISA** oversight. Officials and experts also warned that weak governance or political fragility could splinter vulnerability tracking into competing systems, undermining a core pillar of global cyber defense. The debate has also turned to improving the quality and machine-readability of CVE records at issuance, as **AI-enabled** attacks accelerate exploitation and reduce the value of delayed enrichment; CISA said a brief renewal delay in April 2025 did not interrupt operations and that **MITRE** remains the program operator.
Jun 29, 2026