Posit Becomes CVE Numbering Authority for Its Software

BOSTON, Oct. 27, 2026 /CourierPR/ -- Posit, the company behind RStudio, Positron, Shiny, and Quarto, has been authorized by the CVE Program as a CVE Numbering Authority (CNA). This means Posit can now assign CVE IDs and publish CVE Records for vulnerabilities in its software and hosted services, ensuring that customers and researchers receive authoritative information directly from the team that builds and fixes the software.

The authorization covers Posit's commercial software, including Posit Workbench, Posit Connect, and Posit Package Manager, as well as its hosted services such as Posit Connect Cloud, Posit Cloud, and shinyapps.io. For hosted services, Posit will assign CVE IDs when customers need to take action or require the record to assess their exposure. The authorization also extends to Posit's open-source software, including RStudio, Positron, Quarto, Shiny, and the R and Python packages Posit maintains.

Until now, Posit relied on other CNAs, such as MITRE and GitHub, to assign CVE IDs for its products. As a CNA, Posit will have the first opportunity to assign IDs for vulnerabilities in its scope. This includes the ability to reserve an ID before disclosure, ensuring that the first public advisory includes it. Posit will also publish CVE Records that list affected and fixed versions and provide a CVSS v4.0 severity score. These records will be used by vulnerability scanners and security teams to prioritize and address vulnerabilities.

Rick Johnson, Vice President of Information Technology & Security at Posit, emphasized the importance of this new role.

Posit publishes security advisories at https://trust.posit.co/updates, and CVE Records for Posit software appear in the CVE List at https://cve.org. Posit's commitment to transparency and security is further demonstrated by its role as a CNA, ensuring that the company can provide timely and accurate information to its customers and the broader cybersecurity community.

The authorization covers all Posit products, including commercial software, hosted services, and open-source software. For hosted services, Posit assigns a CVE ID when customers must act or need the record to assess their exposure. The maintainers of third-party packages that Posit Package Manager distributes handle vulnerabilities in those packages, and other CNAs handle vulnerabilities in the software they cover.

Until now, Posit has relied on other CNAs, such as MITRE and GitHub, to assign CVE IDs for its products. As a CNA, Posit has the first opportunity to assign IDs for vulnerabilities in its scope. Posit can reserve an ID before disclosure so the first public advisory includes it, and can publish a CVE Record that lists affected and fixed versions and a CVSS v4.0 severity score. Vulnerability scanners read those records, and security teams use the results to decide what to patch first.

Posit publishes security advisories at https://trust.posit.co/updates, and CVE Records for Posit software appear in the CVE List at https://cve.org. Posit's security advisories provide detailed information on vulnerabilities, affected versions, and the steps taken to address them. The company's commitment to transparency and security is further demonstrated by its role as a CNA, ensuring that the company can provide timely and accurate information to its customers and the broader cybersecurity community.