The world's vulnerability-numbering system quietly grew a second pole - ENISA's root now holds 20 authorities, 8 moved over from MITRE
ENISA announced that its CVE Root now holds 20 CVE Numbering Authorities - 12 onboarded directly and 8 transferred from the MITRE Root - with NATO's Communications and Information Agency (NCIA) and the AI-security firm AISLE newly joined. The global system that assigns identity to software vulnerabilities is gaining a second center of gravity, on the agency's own record.
Source: ENISA press release, August 6, 2026 (the EU agency's own record)·Entered the record: 2026-08-07·Published: 2026-08-07
What would prove this wrong: This signal weakens if CNAs transfer back toward the MITRE Root, if the ENISA Root's authority count stalls or shrinks over the next year, or if CVE issuance under the ENISA Root remains marginal relative to the program total.
Associates briefed T+0. Subscribers T+7. This is the public record.
What the record shows
Read from ENISA's own press page by this desk on 2026-08-07. In the agency's words, dated August 6: there are currently 20 CNAs under the ENISA Root - 12 onboarded directly by ENISA, 8 transferred from the MITRE Root - with NCIA and AISLE the newest to join.
Why it matters for people
CVE numbers are the shared language of every security team, scanner, and patch pipeline on Earth. For two decades that language had one administrative center. A second root growing inside the EU - with NATO's IT agency now issuing under it - is infrastructure change of the quiet kind: it shifts where vulnerability disclosure is governed, which rules apply to it, and where the security professions that depend on it will find their standards written. For anyone whose livelihood touches security operations, compliance, or software supply chains, the ground is moving a year before any headline will say so.
What this does not show
It does not establish fragmentation, duplication of CVE identity, or any change in how vulnerabilities are scored. The program remains one program; what changed is the distribution of its authority.