A CVE Numbering Authority, or CNA, is an organization authorized to assign CVE identifiers and publish official vulnerability records. CNAs can be vendors, security researchers, bug-bounty platforms, or coordination groups. When they disclose a flaw, they attach a unique CVE ID and usually provide details such as affected versions, severity context, references, and sometimes a weakness classification such as CWE.
CNAs matter because they keep vulnerability reporting consistent and machine-readable across the security ecosystem. Defenders use CNA records to deduplicate alerts, prioritize patching, and correlate advisories with scanner results and threat intelligence. In real attacks, a newly published CNA record can help teams quickly recognize whether a public exploit targets software they run. Good CNA records improve response speed; incomplete or vague records make triage harder and can hide recurring design or implementation weaknesses that should be fixed at the source.