ENISA Seeks Top-Tier Status in CVE Program
ENISA Seeks Top-Tier Status in CVE Program
https://www.infosecurity-magazine.com/news/enisa-europe-seeks-top-level-root/
Publish Date: 2026-04-15 11:31:00
Source Domain: www.infosecurity-magazine.com
ENISA, the EU’s Cybersecurity Agency, is strengthening its ties with the US-funded Common Vulnerabilities and Exposures (CVE) program, a top leader of the agency has announced.
Invited to speak at VulnCon26’s opening keynote in Scottsdale, Arizona, on April 14, Nuno Rodrigues Carvalho, head of sector for Incidents and Vulnerability Services at ENISA, revealed that the agency was currently being onboarded by the US Cybersecurity and Infrastructure Security Agency (CISA), sole sponsor of the program, to become a top-level root CVE Numbering Authority (TL-Root CNA).
Speaking to Infosecurity after the session, Carvalho said he hopes the European agency can obtain this status “in 2026 or early 2027.”
CNA, Root CNA and TL-Root CNA Explained
Only two entities currently hold TL-Root CNA status: CISA, the program’s sponsor, and MITRE, the US-funded nonprofit which runs the program.
ENISA became a CVE Numbering Authority (CNA) – an organization authorized to assign CVE IDs to vulnerabilities – in 2024. It then became a root CNA – an organization that oversees and coordinates multiple CNAs within a specific domain or region, onboarding new CNAs and resolving disputes – in 2025.
With the TL-Root CNA status, ENISA would become a top-level authority with the responsibility to manage the entire CVE Program alongside CISA and MITRE, setting global policies and ensuring consistency across all Root CNAs and CNAs.
Speaking to Infosecurity, Johannes Kaspar Clos, a responsible disclosure and CSIRT collaboration expert who works on CNA service implantation in Carvalho’s team at ENISA, said the agency’s future expended role in the CVE program is not only aimed at more operational leverage but also enhanced power in policy and administrative decision-making.
“As a Root CNA, we have a bigger operational footprint: we will now onboard new CNAs in Europe instead of MITRE and we are now represented in the Council of Roots helping to shape and operationalize…
