Scality has joined the Common Vulnerabilities and Exposures (CVE) Program as a CVE Numbering Authority (CNA) under the European Union Agency for Cybersecurity (ENISA) Root. In this role, Scality is authorized to assign CVE Identifiers and publish official vulnerability records for security issues identified across its software portfolio, including Scality RING, Scality ARTESCA, and Scality ADI.
Scality became a CNA on July 21, 2026, joining a growing number of European CNAs. It has also strengthened its vulnerability management processes, from providing accurate vulnerability information on the CVE List to moving vulnerabilities it previously disclosed in its technical bulletins into CVE Records, so customers can track them in their existing tools.
The reporting obligations of the EU Cyber Resilience Act (CRA) began on September 11, 2026. Under the CRA, manufacturers of products with digital elements available in the EU market must notify authorities of actively exploited vulnerabilities and severe incidents, starting with an early warning within 24 hours.
Vulnerability information from the source
Enterprise security teams track and prioritize vulnerabilities by CVE ID. Their scanners, ticketing systems and patch workflows are built around those records. Scality customers have directly asked for CVE coverage of Scality software. As a CNA, Scality now controls that path from end to end: it validates a reported vulnerability, assigns the CVE ID and publishes the corresponding CVE Record with affected versions and remediation guidance, coordinated with the release of a fix.
“Our customers run Scality in some of the most regulated environments in the world, and their security teams were clear about what they wanted: vulnerability information from the vendor, in the format their tools already use,” said Anh Nguyen-Phuoc, chief information security officer, Scality. “Becoming a CNA means that when a vulnerability is found in Scality software, it gets its CVE ID and public CVE Record from the people who know the code best, at the moment the fix is ready. It also gives us a seat in the community that keeps the CVE system working, and we are glad to do that under the ENISA Root.”
Part of a broader security and compliance program
CNA status builds on the security practices behind Scality’s products. Scality operates an ISO 27001-certified information security management system. Scality RING, Scality ARTESCA and Scality ADI are built on CORE5, Scality’s five layers of cyber resilience from API to architecture. Scality also publishes a software bill of materials (SBOM) with every ARTESCA release and is on track with its CRA conformity milestones.
“Storage holds the data an organization cannot afford to lose, so storage software has to meet the same disclosure standards as the rest of the security stack,” said Paul Speciale, chief strategy officer, Scality. “Becoming a CNA is a practical commitment to our customers. When something in our software needs fixing, they hear about it from us directly, with an identifier their tools recognize and the guidance to act on it. It sits naturally alongside the cyber resilience we build into every product.”
Availability
Scality CVE Records will be published on CVE.org and on Scality’s security advisories page at Security Advisories | Scality. Security researchers can report suspected vulnerabilities in Scality software to Scality Vulnerability Disclosure Policy | Scality.
Related News:
Scality Launches AI Inference Factory for Enterprise-Owned Infrastructure
