Flock Authorized to Assign CVE IDs for Products
The cybersecurity firm joined the CNA program to accelerate internal vulnerability disclosures and reduce coordination friction.
Updated on Oct. 13, 2026 in Cybersecurity
Live Poll
Do you trust companies to accurately report security vulnerabilities in their own products?
The Cybersecurity and Infrastructure Security Agency has authorized Flock to assign Common Vulnerabilities and Exposures (CVE) IDs to its own products. This designation grants the company status as a CVE Numbering Authority (CNA), bringing the organization into a broader ecosystem of over 550 entities that manage their own security disclosures.
Why it matters
This move enables faster remediation of security defects by allowing the company to directly manage the identification and coordination process. By streamlining communication with security researchers, the company aims to minimize confusion caused by duplicate vulnerability tracking entries.
Flock has joined the ranks of over 550 organizations that hold CVE Numbering Authority status. This internal mandate enables the firm to assess, coordinate, and prioritize security responses, replacing the need for external entities to issue IDs for its products.
The players
CISA
The Cybersecurity and Infrastructure Security Agency is the federal agency within the United States responsible for coordinating national cybersecurity efforts and managing the CVE program.
Flock
A cybersecurity firm that maintains a proprietary security advisories page and has now been designated as a CVE Numbering Authority.
The details
As a CVE Numbering Authority, the company now possesses the administrative permission to assign CVE IDs—unique, standardized identifiers for publicly known cybersecurity vulnerabilities—directly to its own software products. This transition allows the company to integrate vulnerability tracking into its existing security advisories page and vulnerability disclosure policy. The company currently maintains a policy that restricts certain testing methods and does not operate a paid bug bounty program.
Timeline
October 13, 2026: Flock was officially granted the authority to assign CVE IDs.
The Tech Race
The CVE Numbering Authority program acts as a decentralized standard for how over 550 organizations disclose security flaws across the industry. Flock’s integration follows a long-standing industry shift toward vendor-led, rather than third-party, vulnerability management and disclosure processes.
Security researchers and users of the company’s products can expect a more standardized and faster disclosure timeline for new vulnerabilities. The firm's existing security advisories page will now serve as the primary source of truth for CVE-tracked issues affecting their software.
The takeaway
This authorization signals a shift toward internal ownership of the vulnerability disclosure lifecycle, reducing the lag inherent in third-party reporting. Stakeholders should monitor the company's security advisories page to observe how the firm manages its first batch of self-assigned identifiers.
Further reading
For more on how vendors manage emerging threats, explore the Cybersecurity section.
Source note: This article includes information reported by SC Media.
Live Poll
Do you trust companies to accurately report security vulnerabilities in their own products?
