Loading story…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) launched Vulnerability Information and Coordination Environment–New Technology (VINCE-NT), replacing the VINCE platform used for coordinated vulnerability disclosure since 2020. CISA now fully sponsors, hosts, and manages the service, which was originally developed and hosted by Carnegie Mellon University's CERT Coordination Center.
VINCE-NT adds a simplified reporting interface, automated vulnerability triage and advisory-publication workflows, secure multiparty communications and file sharing, collaboration tools, and case-metric reporting. Its standardized terminology and vulnerability-status data more closely align with CSAF and the CVE Record Format; active cases will move to the new platform in coming weeks, while historical and inactive cases remain in the legacy system. The platform remains separate from CISA's federal Vulnerability Disclosure Policy Platform.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
CISA launched VINCE–New Technology (VINCE-NT) as its fully sponsored, hosted, and managed replacement for the original VINCE platform. The new system adds automated advisory workflows, enhanced triage, secure collaboration and file sharing, and case-metric reporting.
Carnegie Mellon University's CERT Coordination Center developed the original Vulnerability Information and Coordination Environment (VINCE), and CISA began using it for vulnerability reporting and coordination.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourceinfosecurity-magazine.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA, the NSA, and international partners published joint guidance urging software manufacturers and online service providers to formalize **coordinated vulnerability disclosure (CVD)** programs for working with external security researchers. The guidance calls for organizations to publish a clear vulnerability disclosure policy, define internal processes for receiving, triaging, remediating, and disclosing reported flaws, and assign **CVE** identifiers where appropriate to improve tracking and transparency. The document also recommends using third-party coordinators such as **CISA** or national **CSIRTs** when organizations need support handling disclosures, and it highlights **safe harbor** language to protect good-faith researchers from legal action. CISA said the practices can help vendors strengthen product security and give customers and critical infrastructure operators a way to assess a supplier’s maturity in handling vulnerability reports and remediation.
Jul 16, 2026CISA has released a new strategic vision for the Common Vulnerabilities and Exposures (CVE) program, aiming to shift from a 'growth era' to a 'quality era' focused on data quality, automation, and broader community engagement. The move follows a near-shutdown of the program due to federal funding threats and ongoing internal turmoil, including significant budget cuts and staff losses at CISA. Industry experts and stakeholders express concerns about the agency's ability to deliver on its roadmap and the future governance of the CVE program, as debates continue over public versus private stewardship and diversified funding.
Jun 29, 2026CISA has confirmed continued support and funding for the Common Vulnerabilities and Exposures (CVE) program through March 2026. The agency outlined plans to modernize the program, diversify funding, and enhance multi-sector collaboration and data quality. CISA emphasized the importance of keeping CVE data free, vendor-neutral, and globally accessible.
Jun 29, 2026