Loading story…
CISA, the NSA, and international partners published joint guidance urging software manufacturers and online service providers to formalize coordinated vulnerability disclosure (CVD) programs for working with external security researchers. The guidance calls for organizations to publish a clear vulnerability disclosure policy, define internal processes for receiving, triaging, remediating, and disclosing reported flaws, and assign CVE identifiers where appropriate to improve tracking and transparency.
The document also recommends using third-party coordinators such as CISA or national CSIRTs when organizations need support handling disclosures, and it highlights safe harbor language to protect good-faith researchers from legal action. CISA said the practices can help vendors strengthen product security and give customers and critical infrastructure operators a way to assess a supplier’s maturity in handling vulnerability reports and remediation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
CISA, the NSA, and international partners published joint guidance on establishing coordinated vulnerability disclosure programs for software manufacturers and online service providers. The guidance recommends a public vulnerability disclosure policy, triage and remediation processes, CVE assignment, use of third-party coordinators, and safe harbor language for good-faith researchers.
2 references tracked. Mallory keeps watching after this page renders.
waterisac.org
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Vulnerability management and responsible disclosure remain central challenges for cybersecurity professionals, with ongoing debates about best practices and the impact of industry processes. One perspective emphasizes the complexity of establishing effective vulnerability management programs, highlighting the need for clear requirements, scoping, target setting, and continuous improvement. Organizations are encouraged to define what they aim to achieve with vulnerability management, set measurable targets, and establish metrics and reporting mechanisms to track progress. The process also involves determining necessary roles, responsibilities, and tools, as well as implementing training and awareness programs to ensure all stakeholders are prepared to respond to vulnerabilities. Continuous improvement is stressed as essential, with organizations advised to start with pragmatic steps and evolve their programs over time. On the disclosure side, the industry recently faced a potential crisis when MITRE, the steward of the CVE catalog, nearly lost U.S. government funding, which could have disrupted the assignment of new vulnerability IDs and slowed global coordination. The last-minute extension of MITRE’s contract by CISA averted this disruption, underscoring the critical role of coordinated vulnerability disclosure. The debate over how vulnerabilities should be disclosed remains contentious, with some advocating for immediate public disclosure to force vendor action, while others warn that this can expose customers to risk before patches are available. The PrintNightmare incident is cited as an example where early disclosure led to widespread emergency mitigations. The lack of global laws governing responsible disclosure means that ethics, customer safety, and reputational risk drive industry behavior. Organizations must balance transparency with the need to protect users from exploitation, and the methods chosen for disclosure can have significant financial, operational, and reputational consequences. Both the management of vulnerabilities within organizations and the broader ecosystem of disclosure practices are evolving, with ongoing discussions about how to best protect customers and maintain trust. The interplay between internal vulnerability management processes and external disclosure frameworks highlights the complexity of the cybersecurity landscape. As new threats emerge and the industry adapts, organizations must remain vigilant in both managing vulnerabilities and participating in responsible disclosure. The recent funding scare with MITRE serves as a reminder of the fragility of the systems that underpin global vulnerability coordination. Ultimately, effective vulnerability management and responsible disclosure are interdependent, requiring collaboration, clear processes, and a commitment to continuous improvement.
Jun 30, 2026
CISA issued **Binding Operational Directive `26-04`** requiring U.S. federal civilian agencies to prioritize vulnerability remediation by risk instead of treating all flaws as equally urgent. The directive tells agencies to rank vulnerabilities using four factors: whether the affected asset is public-facing, whether exploitation can be fully automated, whether compromise could enable full system takeover, and whether there is evidence of active exploitation, including inclusion in CISA’s **Known Exploited Vulnerabilities** catalog. Based on those criteria, agencies now face remediation deadlines ranging from **three days** for the highest-risk cases to **60 days** for lower-priority flaws, while some low-risk issues may be deferred until a planned major system upgrade. CISA said the overhaul is meant to help agencies “patch smarter, not harder” as AI shortens the time between disclosure and weaponization and defenders struggle with limited resources. Agencies must immediately update vulnerability management policies, revise remediation processes within 60 days, and fully implement the directive’s timelines within 180 days; vulnerabilities meeting all four criteria also require forensic triage to determine whether systems were already compromised before patching. CISA said an initial review at one large civilian agency found only about **1%** of vulnerability instances would require the three-day response, while more than **60%** could be deferred, and the agency urged private-sector organizations to adopt similar risk-based practices alongside hardening, segmentation, and phishing-resistant MFA.
Jul 13, 2026
Recent discussions in the cybersecurity community have highlighted the evolving landscape of vulnerability disclosure, particularly focusing on the legal and contractual restrictions imposed by managed bug bounty programs. Experts warn that confidentiality agreements required by some platforms can prevent researchers from publicly sharing their findings, undermining the original intent of coordinated vulnerability disclosure (CVD) and potentially allowing software vulnerabilities to remain unaddressed. This shift has sparked debate about the balance between responsible disclosure, researcher rights, and vendor interests, as well as the broader impact on software security. At the same time, bug bounty programs are increasingly recognized as a strategic solution for organizations seeking to enhance their security posture. These programs offer economic efficiency by leveraging external expertise and paying only for validated vulnerabilities, allowing organizations to redirect resources toward remediation and proactive security initiatives. However, the rise of such programs also brings new challenges, including the need to ensure that legal frameworks do not stifle the open exchange of critical security information or hinder the overall effectiveness of vulnerability management efforts.
Jun 29, 2026