If you cannot reach a vendor, or the issue affects many products, you can report to CISA's coordinated vulnerability disclosure process. CISA triages the report, contacts the supplier, tracks the timeline, decides on a CVE, and helps prepare an advisory. It is not the first choice for every bug.
The stages
CISA describes seven stages:
- Report submission through its VINCE-NT platform.
- Intake and triage: is the report legitimate, actionable, in scope and not already public?
- Coordination: CISA identifies and contacts the supplier, analyzes technical details and mediates.
- CVE determination, with CISA able to act as the authoring CNA.
- Advisory preparation, agreed with the participants.
- Public disclosure, with an advisory, CVE content and CSAF documents.
- Possible evaluation for the Known Exploited Vulnerabilities catalog.
What you get as a reporter
According to CISA: one intake channel, a triage outcome (including referral if CISA is not the right body), coordination and mediation with the vendor, CVE assignment where the rules allow, standard documentation, and a notice when the vulnerability is published.
When it is a good fit
- You tried the vendor's own channel and heard nothing.
- The vendor has no published contact.
- The weakness spans several suppliers, and someone must coordinate them.
- The product is part of infrastructure where public disclosure timing needs care.
If the vendor has a working program, use it first. Direct contact is usually faster, and our post on reporting a vulnerability explains how to find it.
Timing
CISA says disclosure timing depends on exploitation status, impact, vendor responsiveness and available mitigation. If a vendor does not respond, CISA says it may disclose as early as 45 days after first contacting the vendor, even without a patch. That figure is for CISA's own process. Compare it with the 90 day approach in disclosure deadlines explained.
What it does not do
CISA triage can close or refer out-of-scope reports. It does not promise a reward. It is not a substitute for a vendor's bug bounty, and you should read the scope on its page before you submit. Check the current intake rules, since they can change.
Quick check
Does CISA always assign a CVE?
No. It decides whether the issue meets CVE Program rules, and which CNA publishes the record.
Can the vendor see my report?
CISA contacts the supplier and shares the technical details needed to confirm the issue, as part of coordination.
Sources
Last reviewed: 19 October 2026.
