Scality becomes a CVE Numbering Authority
Scality can now assign CVE Identifiers and publish vulnerability records for its own software, giving customers
Press Release Disclaimer: This is a press release distributed through the XPR Media network. It has not been independently verified by our newsroom.
PARIS, Nov. 10, 2026 (GLOBE NEWSWIRE) — Scality, a global leader in data infrastructure software for AI-era storage at scale, has joined the Common Vulnerabilities and Exposures (CVE™) Program as a CVE Numbering Authority (CNA) under the Root operated by the European Union Agency for Cybersecurity (ENISA). As a CNA, Scality assigns CVE Identifiers (CVE IDs) and publishes corresponding CVE Records for vulnerabilities discovered in all of its software products, including Scality RING, Scality ARTESCA and Scality ADI.
Scality became a CNA on July 21, 2026, joining a growing number of European CNAs. It has also strengthened its vulnerability management processes, from providing accurate vulnerability information on the CVE List to moving vulnerabilities it previously disclosed in its technical bulletins into CVE Records, so customers can track them in their existing tools.
The reporting obligations of the EU Cyber Resilience Act (CRA) began on September 11, 2026. Under the CRA, manufacturers of products with digital elements available in the EU market must notify authorities of actively exploited vulnerabilities and severe incidents, starting with an early warning within 24 hours.
Vulnerability information from the source
Enterprise security teams track and prioritize vulnerabilities by CVE ID. Their scanners, ticketing systems and patch workflows are built around those records. Scality customers have directly asked for CVE coverage of Scality software. As a CNA, Scality now controls that path from end to end: it validates a reported vulnerability, assigns the CVE ID and publishes the corresponding CVE Record with affected versions and remediation guidance, coordinated with the release of a fix.
“Our customers run Scality in some of the most regulated environments in the world, and their security teams were clear about what they wanted: vulnerability information from the vendor, in the format their tools already use,” said Anh Nguyen-Phuoc, chief information security officer, Scality. “Becoming a CNA means that when a vulnerability is found in Scality software, it gets its CVE ID and public CVE Record from the people who know the code best, at the moment the fix is ready. It also gives us a seat in the community that keeps the CVE system working, and we are glad to do that under the ENISA Root.”
Part of a broader security and compliance program
CNA status builds on the security practices behind Scality’s products. Scality operates an ISO 27001-certified information security management system. Scality RING, Scality ARTESCA and Scality ADI are built on CORE5, Scality’s five layers of cyber resilience from API to architecture. Scality also publishes a software bill of materials (SBOM) with every ARTESCA release and is on track with its CRA conformity milestones.
“Storage holds the data an organization cannot afford to lose, so storage software has to meet the same disclosure standards as the rest of the security stack,” said Paul Speciale, chief strategy officer, Scality. “Becoming a CNA is a practical commitment to our customers. When something in our software needs fixing, they hear about it from us directly, with an identifier their tools recognize and the guidance to act on it. It sits naturally alongside the cyber resilience we build into every product.”
Availability
Scality CVE Records will be published on CVE.org and on Scality’s security advisories page at Security Advisories | Scality. Security researchers can report suspected vulnerabilities in Scality software to Scality Vulnerability Disclosure Policy | Scality.
About Scality
Scality builds data infrastructure software for enterprise AI, cyber resilience, and sovereign control at multi-petabyte to exabyte scale. Its platform reduces operational burden while aligning the right storage media, performance, and protection to each workload through human-approved lifecycle policies. Built on CORE5 cyber resilience and open-code principles, Scality software delivers extreme performance, operational simplicity, and sustainable economics. The world’s most demanding enterprises and government organizations depend on Scality to power AI initiatives, defend critical data, and build infrastructure that lasts for decades. Recognized as a leader by Gartner, Scality is where AI remembers, learns, and thinks. Follow us on LinkedIn. Visit www.scality.com and our blog.
Media contacts:
Erin Jones
Avista Public Relations for Scality
805.440.6587
scality@avistapr.com
Media gallery
