Scality joins CVE Program as numbering authority

Scality, which builds data infrastructure software for storage at scale, has become a CVE Numbering Authority within the CVE Program. The designation lets the company assign CVE Identifiers and publish CVE Records for vulnerabilities in its own products, giving customers security information directly from the vendor.

Reporting obligations under the EU Cyber Resilience Act took effect September 11, 2026. Manufacturers of products with digital elements made available in the EU market must notify authorities of actively exploited vulnerabilities and severe incidents, starting with an early warning within 24 hours. Enterprise security teams sort and prioritize vulnerabilities by CVE ID, and their scanners, ticketing systems, and patch workflows depend on those records.

Under the arrangement with the Root operated by the European Union Agency for Cybersecurity (ENISA), Scality assigns CVE IDs and publishes CVE Records for vulnerabilities found in its software, including Scality RING, Scality ARTESCA, and Scality ADI. Its process begins with validating a reported vulnerability, then assigning the identifier and publishing the record with affected versions and remediation guidance, timed to the release of a fix.

Scality became a CNA on July 21, 2026, joining a growing number of European CNAs. The company has also tightened its vulnerability management processes, providing accurate information to the CVE List and moving vulnerabilities previously disclosed in technical bulletins into CVE Records so customers can track them in their existing tools. Records are published on CVE.org and on the security advisories page of Scality.

“Becoming a CNA means that when a vulnerability is found in Scality software, it gets its CVE ID and public CVE Record from the people who know the code best, at the moment the fix is ready.” said Anh Nguyen-Phuoc, chief information security officer, Scality.

Scality operates an ISO 27001-certified information security management system. RING, ARTESCA, and ADI are built on CORE5, which comprises five layers of cyber resilience from API to architecture. The company publishes a software bill of materials with every ARTESCA release. Scality is on track with its CRA conformity milestones.