Skip to content
Contact Sales Free Trial Buy Now
Developer Blog

Owning Our Security Story: Nitro Becomes a CVE Numbering Authority (CNA)

Alan Gordon

Director, IT & Security

We're pleased to share that Nitro has joined the Common Vulnerabilities and Exposures (CVE™) Program as a CVE Numbering Authority (CNA) under the ENISA Root, the European Union Agency for Cybersecurity. It's a behind-the-scenes change, but an important one for how we handle and communicate cybersecurity issues in our products. Here's what it is, why we did it, and what it means for our customers.

First, what's a CVE?

When a cybersecurity vulnerability is found in software, it needs a name everyone can agree on. That's what a CVE Identifier (CVE ID) is - a unique ID like CVE-2026-12345 that vendors, researchers, security tools and IT teams all use to refer to the same issue.

If you've ever checked a vulnerability scanner, read a security advisory or patched a system because of a news story, you've probably seen one. CVE IDs are how the security world keeps track of what's been found and what's been fixed.

What does a CNA do?

A CVE Numbering Authority is an organisation authorised to assign CVE IDs and publish corresponding CVE Records for vulnerabilities within a defined scope. There are more than 550 CNAs worldwide, including major software vendors, security firms and national CSIRTs.

CNAs are organised under Roots, which recruit, train, onboard and support them. ENISA became a Root in November 2025 to strengthen Europe's contribution and alignment to the global vulnerability ecosystem, and more than 20 organisations and national CSIRTs currently sit under it. Nitro is now one of them.

Our scope is Nitro's own products. That means we assign and publish CVEs for vulnerabilities found in Nitro software - not for third-party products.

Why we did it

Until now, when we needed a CVE for an issue in a Nitro product, we had to request one through MITRE CNA-LR. But now that Nitro is a CNA, we own that process end to end. When a vulnerability is confirmed, our security team can reserve a CVE ID straight away, line its publication up with the fix, and write the CVE Record ourselves.

Security issues are a reality for every software company. What sets companies apart is how openly and responsibly they deal with them. Being a CNA puts that responsibility squarely with us - we find it, we fix it, and we tell our customers clearly what happened and what to do. It also means we're part of a network of European CNAs that's growing in importance, alongside other organisations that take disclosure as seriously as we do.

What changes for customers

  • Faster information: CVEs can be published alongside our fixes, so you're not waiting on a separate process to know what changed

  • More useful records: affected versions, severity and remediation guidance come directly from the team that knows the product

  • Easier tracking: vulnerability scanners and security tools pick up CVE Records automatically, so your team can track Nitro issues the same way as everything else in your environment

What changes for security researchers

If you find a vulnerability in a Nitro product, you now work with one team from first report to published CVE. Our responsible disclosure program stays the same: report it to us, we'll confirm and fix it, and we'll credit your work in the published record where you'd like us to.

You can find more information on our Responsible Disclosure Program in the links below.

Find out more