Scality can now assign CVE identifiers and publish vulnerability records for its own software, after joining the CVE Program as a CVE Numbering Authority (CNA) under the root operated by the EU's cybersecurity agency, ENISA. The storage software vendor became a CNA on 21 July 2026 and announced it on 10 November.
The authority covers all Scality products, including RING, ARTESCA and ADI. Scality has also moved vulnerabilities it previously disclosed in technical bulletins into CVE Records, so customers can follow them in the scanners and ticketing systems they already use. Records will carry affected versions and remediation guidance, published alongside the fix on CVE.org and on Scality's security advisories page.
Timing matters because reporting obligations under the EU Cyber Resilience Act began on 11 September 2026. Manufacturers of products with digital elements sold in the EU must notify authorities of actively exploited vulnerabilities and severe incidents, starting with an early warning within 24 hours. Scality says it is on track with its conformity milestones, runs an ISO 27001-certified information security management system and publishes a software bill of materials with every ARTESCA release.
Anh Nguyen-Phuoc, Scality's chief information security officer, said: "Becoming a CNA means that when a vulnerability is found in Scality software, it gets its CVE ID and public CVE Record from the people who know the code best, at the moment the fix is ready."
To stay across the latest in cloud, AI and enterprise tech analysis from Compare the Cloud, subscribe to our weekly newsletter at https://www.comparethecloud.net/newsletter
