In short
The CVE program is decentralized: more than 400 organizations assign identifiers, each within its own scope. That is what gives the program its coverage and speed. It is also why a CVE record is sometimes complete down to the last field, and sometimes unusable.
· 6 min read.
What a CNA actually does
When a researcher reports a flaw in a product, they contact the CNA that covers that product — usually the vendor itself. The CNA reserves an identifier, keeps the details confidential while the fix is prepared, then publishes the record on disclosure day.
MITRE plays no part in this process: it authorizes CNAs, settles disputes and serves as a safety net for products no one covers. In other words, the quality of what you read in a CVE record does not depend on the program: it depends on the organization that published it.
The CNAs you will run into most often
The complete official list is published and kept up to date by the CVE program; we do not copy its hundreds of rows here, as they would be out of date within a month. Here, instead, are the ones whose publications make up most of a French-language monitoring feed:
| CNA | Type | Scope |
|---|---|---|
| MITRE | Root and secretariat | Any product without an assigned CNA; program arbitration |
| Microsoft | Vendor | Windows, Office, Azure and the related ecosystem |
| Apple | Vendor | macOS, iOS, Safari and services |
| Google / Chrome | Vendor | Chrome, Android, Google services |
| Red Hat | Vendor | RHEL and the open source packaged by Red Hat |
| Cisco | Vendor | Network equipment and related software |
| Oracle | Vendor | Database, Java, enterprise applications |
| GitHub (GHSA) | Vendor and coordinator | Dependencies in the npm, PyPI, Maven, RubyGems… ecosystems |
| CERT/CC | Coordinator | Products whose vendor is not a CNA, coordinated disclosure |
| CISA / ICS-CERT | Government | Industrial systems and critical infrastructure |
| Patchstack, Wordfence | Researcher | WordPress plugins and themes, at very high volume |
Four families, four behaviors
| Type | What it publishes | What to expect from it |
|---|---|---|
| Vendor | Flaws in its own products | Precise affected versions, and a fix the same day |
| Coordinator | Flaws in third-party products with no authorized vendor | A careful description, sometimes with no fix available |
| Researcher / platform | Flaws reported by its community | Volume, with completeness that varies from one record to the next |
| Government | A national or sector-specific scope | Coverage of areas the market serves poorly |
CNA, Root, ADP: who does what
- CNA: assigns and publishes the identifiers within its scope.
- Root: oversees a group of CNAs, recruits them and settles disputes. MITRE is the root of last resort.
- ADP (Authorized Data Publisher): does not assign identifiers but enriches existing records. CISA is one, through its Vulnrichment program, which adds scores and classifications to records that lack them.
This last role has grown in importance since NVD enrichment slowed down: a share of records are now completed through this channel rather than through the historical path.
Why the CNA determines the quality of your alerts
A CVE record with no affected version and no standardized product identifier cannot be matched against any inventory: no tool, whatever it is, can guess whether it affects you. It will end up either ignored or surfaced “just in case” — in other words, as noise.
Yet whether these fields are present depends entirely on the publishing CNA. Some publish quickly and sparsely; others publish slowly and completely. This is a structural feature of the program, not an accident: that is why we measure source completeness and why we cross-check every record against several feeds.
What it means for you, in practice
Two useful habits:
- Check who is publishing before concluding that an alert is vague. A terse record from a high-volume CNA often means you need to read the vendor's advisory, which is precise.
- Report incomplete records. CNAs accept correction requests, and an enriched record benefits everyone — including your monitoring tool the following month.
Key takeaways
- A CNA assigns and publishes the CVEs within its scope.
- Four families: vendor, coordinator, researcher, government.
- Hierarchy: CNA → Root → root of last resort; ADPs enrich without assigning.
- Publication volume says nothing about quality, and quality is what makes an alert actionable.
FAQ
How many CNAs are there?
More than 400 authorized organizations worldwide, and the number grows every month. The official list published by the CVE program is the only up-to-date one; any figure frozen in an article goes stale within weeks.
Can a CNA fill in its CVEs poorly?
Yes, and it happens mostly with those that publish at very high volume. The missing fields are most often the affected version and the standardized product identifier — precisely the two that enable automatic matching against an inventory.
How does an organization become a CNA?
By applying to a Root, committing to follow the program rules (timelines, record format, declared scope) and designating a reachable security contact. The process is open to vendors and open source projects alike.