Stepping up the ENISA's role in Support of EU Vulnerability Services

Stepping up the ENISA's role in Support of EU Vulnerability Services

Speakers: Johannes Kaspar Clos, Operational Cooperation Unit, ENISA

Conference: VulnCon

YouTube: https://www.youtube.com/watch?v=9qQUbDoa0-k

Overview

In this insightful talk from VulnCon, Johannes Kaspar Clos from the European Union Agency for Cybersecurity (ENISA) outlined the agency's rapidly expanding mandate and strategic initiatives aimed at bolstering Europe's vulnerability management ecosystem. The presentation, titled "Stepping up the ENISA's role in Support of EU Vulnerability Services," detailed how ENISA is responding to the escalating threat landscape, characterized by increasingly rapid vulnerability weaponization and persistent patching challenges. Clos articulated ENISA's commitment to establishing robust, EU-specific services, including an enhanced EU Vulnerability Database, a new single reporting platform for actively exploited vulnerabilities, and a catalog for non-exploited vulnerabilities.

The core message emphasized the critical need for a more coordinated and efficient approach to vulnerability management across the EU member states. Clos highlighted how recent and upcoming EU legislations, such as the NIS2 Directive, the Cyber Resilience Act (CRA), and the proposed Cybersecurity Act 2.0, are formalizing ENISA's pivotal role in this domain. By becoming a root CNA (CVE Numbering Authority) and aspiring to be a top-level root, ENISA aims to provide essential infrastructure and enrichment services, fostering a stronger, more resilient digital environment for all European citizens and organizations. This strategic pivot is not about fragmenting global efforts but rather complementing and strengthening the existing international vulnerability management backbone, particularly through continued cooperation with entities like CISA.

Background

▶ Watch: Introduction: Speaker and ENISA's mandate (0:00)

The landscape of cybersecurity threats is evolving at an alarming pace, making effective vulnerability management more critical than ever. Johannes Kaspar Clos highlighted that while traditional attack vectors like phishing remain prevalent, the exploitation of vulnerabilities has emerged as a high-value methodology for diverse attacker groups. Vulnerabilities offer repeatable initial access and serve as a starting point for lateral movement within networks, making them a cornerstone of modern cyberattacks. ENISA's threat landscape reports consistently underscore this trend, showing a significant acceleration in the weaponization of vulnerabilities, often within days of their public disclosure.

Historical data presented in the talk revealed a steep decline in the time between vulnerability disclosure and its deployment in attack campaigns. What once took weeks or months has now shrunk to little more than a day, with projections for this to further reduce to 1.6 days by 2026. This rapid weaponization presents an immense challenge for defenders, who are already struggling with slow patching cycles. Clos cited alarming statistics: 54% of edge vulnerabilities are not fully remediated, and the median time to remediate a vulnerability stands at an "unbearable" 32 days. This stark disparity between attacker speed and defender response time creates a vast window of opportunity for exploitation. While state-aligned actors and APT groups were historically the primary users of zero-day exploits, cybercriminal groups are now rapidly adopting and utilizing vulnerabilities, broadening the impact and reach of these attacks. This pressing reality forms the impetus for ENISA's intensified focus on developing comprehensive vulnerability services within the EU, building upon existing global frameworks provided by organizations like CISA, NIST, and MITRE.

Key Findings

▶ Watch: Foundational EU legislation for vulnerability services (10:10)

ENISA's presentation underscored a significant strategic shift within the European Union to formalize and enhance its vulnerability management capabilities. This pivot is driven by a series of legislative actions and ENISA's expanding operational mandate, aiming to create a robust and coordinated EU-wide ecosystem.

The bedrock of these developments lies in three key EU legislations:

1. NIS2 Directive: This directive mandates that member states assign national coordinators for cybersecurity and publish their own Coordinated Vulnerability Disclosure (CVD) policies. Crucially, it tasks ENISA with developing the EU Vulnerability Database (EUVDB), an initiative that launched in April 2023.
2. Cyber Resilience Act (CRA): A landmark legislation focusing on product security, the CRA obliges vendors to report actively exploited vulnerabilities within a specific timeframe. This reporting must be done via a Single Reporting Platform operated by ENISA, which is slated for launch by September 2026. This represents a significant new compliance requirement for all product vendors operating in the EU market, irrespective of whether their products are used in critical infrastructure or by consumers.
3. Cybersecurity Act 2.0 (Proposed): This upcoming legislation further expands ENISA's role in CVD, allowing the agency to become more active in vulnerability disclosure beyond member state efforts. It formalizes ENISA's responsibility for maintaining the EUVDB and mandates the inclusion of richer, more complete vulnerability context, including information on non-exploited vulnerabilities.

In response to these legislative mandates and the evolving threat landscape, ENISA is actively pursuing several key initiatives:

• The EU Vulnerability Database (EUVDB): Launched in April 2023, the EUVDB provides contextual information for vulnerabilities, building on CVE identifiers. It includes scores, known exploitation details, and aims to support automation. While currently focused on CSAF intake, ENISA plans to enable CSAF publication in a new version of the EUVDB within months, enhancing interoperability and information sharing.
• Root CNA Status and Top-Level Ambition: ENISA became a Root CNA in November 2025, enabling it to onboard and manage other CNAs. The agency's long-term goal is to become the European Top-Level Root for CVE assignments, supporting conflict resolution and strategic planning within the global CVE program.
• EU Non-Exploited Vulnerability Catalog: This is a crucial work-in-progress initiative. The catalog aims to compile a comprehensive list of non-exploited vulnerabilities based on authorized input from various sources. Initially drawing from EU CSIRT network incident response activities, it will expand to include CRA-reported non-exploited vulnerability information, data from the Themis platform (incident reports from critical infrastructure sectors), and validated information from honeypot services like Shadow Server.
• Vulnerability Enrichment Services: Beyond basic identification, ENISA plans to offer services that provide further contextual information, such as EPSS scores, and fill in missing data in vulnerability records, thereby supporting both CNAs and end-users with more actionable intelligence.

These findings highlight ENISA's proactive stance in creating a centralized, comprehensive, and legally mandated framework for vulnerability management within the EU, designed to address the unique challenges and requirements of the European digital landscape while fostering global collaboration.

Technical Deep Dive

▶ Watch: ENISA as Root CNA and vulnerability catalog (16:50)

ENISA's efforts in vulnerability services are underpinned by several technical and operational advancements, designed to create a cohesive and robust framework for the European Union.

The EU Vulnerability Database (EUVDB), launched in April 2023, serves as a central repository for vulnerability information within the EU. It is designed to provide richer context around vulnerabilities identified by CVE identifiers. This includes not just basic descriptions but also CVSS scores, information on known exploitation, and additional data points such as EPSS scores, which were incorporated based on practitioner needs. The EUVDB is being developed with automation in mind, currently supporting CSAF (Common Security Advisory Framework) for intake. A significant upcoming enhancement, expected within months, is the capability for CSAF publication, which will allow the EUVDB to disseminate vulnerability information in a standardized, machine-readable format, improving interoperability with other security tools and platforms. ENISA is actively engaging with the CSIRT network and industry stakeholders through ad hoc working groups to gather feedback and ensure the EUVDB's usability and relevance.

A cornerstone of the upcoming Cyber Resilience Act (CRA) is the Single Reporting Platform, which ENISA is mandated to operate. This platform, scheduled for launch by September 2026, will serve as the mandatory conduit for vendors to report actively exploited vulnerabilities for any product they place on the European Union market. This requirement extends beyond critical infrastructure to all consumer products, making its scope potentially broader than existing reporting mechanisms like the CISA CAF for certain vendors. This platform is a critical component for aggregating real-time exploitation intelligence at the EU level, enabling faster collective response.

The EU Non-Exploited Vulnerability Catalog is another significant technical undertaking. Unlike databases focused solely on exploited vulnerabilities, this catalog aims to provide a comprehensive view of vulnerabilities that, while known, have not yet been observed in active exploitation. The compilation process for this catalog is multi-sourced and highly validated:

1. EU CSIRT Network Incident Response: Information derived from validated incident response activities conducted by national CSIRTs across EU member states.
2. CRA Reporting: Future inclusion of non-exploited vulnerability information reported by vendors via the Single Reporting Platform, as mandated by the CRA.
3. Themis Platform: Data gathered from incident reports originating from critical infrastructure sectors, which are submitted to ENISA's central hub.
4. Shadow Server Collaboration: Integration of validated information identified through honeypot services, providing insights into attempted exploitation and emerging threats.

This multi-source approach aims to create a more complete and actionable intelligence picture for defenders, allowing them to prioritize patching and mitigation efforts even before widespread exploitation occurs.

ENISA's role as a Root CNA (since November 2025) is a technical and organizational commitment to the global CVE Program. This status allows ENISA to onboard and manage other CNAs within the EU, providing support for CVE assignment and coordination. The agency's ambition to become a Top-Level Root for Europe signifies its intent to take on greater responsibilities in conflict resolution and strategic planning within the CVE ecosystem, ensuring that European contributions and needs are adequately represented and addressed.

Finally, ENISA is developing Vulnerability Enrichment Services. These services are designed to augment existing vulnerability records with additional context and data. This includes providing scoring capacities (e.g., CVSS, EPSS) and filling in information that might be lacking in initial CVE records. The goal is to provide CNAs with the tools to create more complete and actionable vulnerability descriptions, and for end-users to receive richer, more refined intelligence, ultimately speeding up the decision-making process for mitigation and remediation. This collective technical infrastructure aims to streamline information flow, improve data quality, and accelerate response times across the EU.

Demo / Proof of Concept

▶ Watch: Future plans: Top-level root CNA and enrichment (21:00)

This talk primarily focused on strategic initiatives, legislative frameworks, and the roadmap for ENISA's services, rather than demonstrating a specific tool or proof of concept. Johannes Kaspar Clos detailed the functionalities and upcoming features of the EUVDB, the Single Reporting Platform, and the EU Non-Exploited Vulnerability Catalog, explaining their purpose and anticipated impact within the EU's cybersecurity landscape.

Defensive Implications

▶ Watch: CRA: Mandatory reporting to EU platform (29:40)

ENISA's expanded role and the new legislative frameworks carry significant implications for defenders across the European Union, from national CSIRTs to individual organizations and product vendors. The overarching goal is to equip defenders with richer, more timely, and actionable vulnerability intelligence to counter the accelerating threat landscape.

For EU organizations and critical infrastructure operators, the EU Vulnerability Database (EUVDB) will become an increasingly vital resource. By leveraging its contextual information, including exploitation status and EPSS scores, organizations can enhance their vulnerability prioritization processes, focusing resources on threats with the highest potential impact. The upcoming CSAF publication capability will also facilitate automated integration of EUVDB data into existing vulnerability management tools, streamlining workflows. Furthermore, the developing EU Non-Exploited Vulnerability Catalog will offer proactive intelligence, allowing defenders to address vulnerabilities before they are widely weaponized, shifting from a reactive to a more predictive security posture.

Product vendors operating within the EU market face a significant new compliance obligation under the Cyber Resilience Act (CRA). By September 2026, they will be legally required to report actively exploited vulnerabilities in their products to ENISA's Single Reporting Platform. This mandate extends to all products, including consumer goods, making it a broader requirement than some existing reporting frameworks. Vendors must integrate this reporting into their incident response plans and ensure they have robust internal processes to identify and track exploited vulnerabilities. Failure to comply could result in significant penalties. Additionally, vendors might consider becoming a CNA under ENISA's root to streamline their vulnerability disclosure processes and contribute directly to the global CVE ecosystem.

For EU Member State CSIRTs, ENISA's initiatives foster enhanced collaboration and information sharing. Their incident response activities will directly feed into the EU Non-Exploited Vulnerability Catalog, contributing to a collective intelligence picture. ENISA's role as a Root CNA and its ambition to become a Top-Level Root will also provide a more coordinated framework for CVE assignment and vulnerability coordination within Europe, potentially reducing fragmentation and improving consistency.

Broadly, the emphasis throughout the talk on the rapid weaponization of vulnerabilities (projected to be 1.6 days by 2026) serves as a stark reminder for all defenders: faster patching and remediation are paramount. Organizations must critically evaluate their patching cycles and strive to reduce the median 32-day remediation time to something far more agile. This requires investing in automation, robust asset management, and continuous vulnerability scanning. The integration of AI acceleration in attack methodologies further underscores the urgency of this defensive speed-up.

Finally, ENISA's commitment to supporting a "global vulnerability management backbone" highlights the importance of international cooperation. Defenders should view ENISA's services not as isolated EU-specific tools, but as part of a broader collaborative effort to improve cybersecurity worldwide, leveraging information and best practices shared with partners like CISA.

Key Takeaways

• Accelerated Vulnerability Threat: The time between vulnerability disclosure and weaponization has drastically reduced to just over a day, projected to be 1.6 days by 2026, demanding significantly faster defensive responses and patching.
• EU Legislative Mandate: New EU laws like the NIS2 Directive (mandating national CVD policies, ENISA's EUVDB), the Cyber Resilience Act (CRA) (requiring mandatory reporting of exploited vulnerabilities to ENISA), and the proposed Cybersecurity Act 2.0 are formalizing and expanding ENISA's central role in EU vulnerability management.
• ENISA's Core Services: ENISA is developing and enhancing key services: the EU Vulnerability Database (EUVDB) (with CSAF intake/publication), a Single Reporting Platform for CRA compliance, and an EU Non-Exploited Vulnerability Catalog (fed by CSIRTs, CRA, Themis, and Shadow Server).
• Strengthening CVE Coordination: ENISA has become a Root CNA (Nov 2025) and aims to be the European Top-Level Root, enhancing CVE assignment, conflict resolution, and strategic planning within the global CVE program.
• Mandatory Vendor Reporting: Under the CRA, product vendors selling in the EU must report actively exploited vulnerabilities to ENISA's Single Reporting Platform by September 2026, a significant new compliance requirement with broad scope.
• Collaborative Approach: ENISA emphasizes international cooperation (e.g., with CISA) to build a global vulnerability management backbone, actively seeking community input through ad hoc working groups and hiring to refine its services and operational capacity.

About the Speaker(s)

Johannes Kaspar Clos is a key figure at ENISA, the European Union Agency for Cybersecurity, where he is seconded from Germany's Federal Agency for Information Security (BSI). With four years of experience in ENISA's operational cooperation unit, Clos specializes in various aspects of vulnerability management and vulnerability disclosure. His work involves supporting EU member states in increasing their capacities in these critical areas, aligning with ENISA's mandate to bolster cybersecurity across the European Union.