Flock Granted Authority to Assign CVE IDs

The cybersecurity firm joins over 550 organizations authorized by CISA to manage internal security defect identification.

Updated on Oct. 13, 2026 in Cybersecurity

Bold flat-color editorial illustration showing a stylized metal container on a plinth with a red geometric lock, representing vulnerability management authority. — The Cybersecurity and Infrastructure Security Agency has authorized Flock to serve as a CVE Numbering Authority for its software products. AI Illustration. Upload story photo >

Live Poll

Do you trust companies to accurately report security vulnerabilities in their own products?

The Cybersecurity and Infrastructure Security Agency (CISA) has authorized Flock to function as a CVE Numbering Authority. This designation allows the company to independently assign CVE IDs to its own software products.

Why it matters

By managing these identifiers internally, the company intends to expedite response times for researcher findings. This process also helps reduce confusion that can arise from duplicate vulnerability entries across the security industry.

Flock now joins a roster of over 550 organizations that operate as CVE Numbering Authorities. This status allows for the internal assessment, coordination, and prioritization of security defects without immediate external reliance.

The players

CISA

The Cybersecurity and Infrastructure Security Agency is a federal agency that works to protect the digital and physical infrastructure of the United States.

Flock

Flock is a technology company that maintains its own security advisories page and vulnerability disclosure policy.

The details

The designation empowers the company to handle vulnerability disclosures directly through its established security advisories page and vulnerability disclosure policy. However, the company does not currently maintain a paid bug bounty program and enforces specific restrictions on acceptable testing methods.

October 13, 2026: Flock was granted the authority to assign CVE IDs.

The Tech Race

This move follows the standards established by the Common Vulnerabilities and Exposures (CVE) Program to modernize vulnerability tracking. It reflects a broader industry trend of decentralizing security management to allow vendors to respond to emerging threats with greater agility.

Users of Flock products may notice more consistent and timely security advisories as the company begins self-assigning identifiers. This shift aims to streamline the remediation process for software flaws, potentially reducing the time required to patch vulnerabilities.

The takeaway

Centralizing the CVE ID assignment process allows companies to exert greater control over their internal security lifecycle. Organizations often find that this status facilitates better communication with external researchers while maintaining rigorous oversight of incoming vulnerability reports.