What happens after you report a vulnerability to CISA: the seven steps

CISA's public process has seven steps: report submission, intake and triage, coordination, CVE determination, advisory preparation, public disclosure and Known Exploited Vulnerabilities evaluation. CISA says it may disclose as early as 45 days after the first contact attempt if a vendor is unresponsive.

Step 1: report submission

A researcher, supplier or other party reports a suspected vulnerability to CISA through VINCE-NT. Use the checklist in what to put in a vulnerability report so triage has what it needs.

Step 2: intake and triage

CISA's CVD team checks whether the report appears legitimate, is actionable, is in scope, is already known or public, and meets coordination criteria. Reports outside scope are referred or closed.

That list is useful for you as a reporter. Before you submit, ask: can someone reproduce this, is it a product issue and not a configuration mistake, and has it been published already?

Step 3: coordination

CISA identifies and contacts the supplier, performs technical analysis and vendor confirmation, tracks the timeline, mediates between reporter and vendor when needed, and drafts advisory language.

Step 4: CVE determination

If applicable, CISA decides whether the issue qualifies for a CVE ID and which CNA will publish the record. CISA may act as the authoring CNA.

Step 5: advisory development

Participants agree on the final advisory text, publication timing and disclosure plans. This is where reporters can ask about credit.

Step 6: public disclosure

CISA publishes an advisory, enriched CVE record content and CSAF documents. It notifies reporters and vendors of publication. The vendor's remediation timeline, which the page does not describe as a separate step, runs alongside.

Step 7: KEV evaluation

The process then continues with evaluation for the Known Exploited Vulnerabilities catalog. Readers who prioritize patching can see how entry fits the wider picture in what is the CISA KEV catalog.

The 45 day rule

The only exact number on the page is 45 days. CISA says it may disclose vulnerabilities as early as 45 days after the first attempt to contact the vendor when the vendor is unresponsive or will not set a reasonable remediation timeframe, whether or not a patch exists. Other factors affect timing, including disclosure status, potential impact and mitigation availability, but no numbers are given for them.

What to do while you wait

• Keep your own copy of evidence and the timeline.
• Do not discuss details publicly while coordination is active, unless you have agreed otherwise.
• Answer coordinator questions quickly. Delays on your side lengthen the process.
• If you are also a user of the software, apply mitigations that do not reveal the issue.

If you are the vendor on the receiving end

Respond to the coordinator promptly, confirm or dispute with evidence, and give a fix date. See what a good advisory contains. Safeguard's zero-day discovery work, and its policies and gates, help teams that receive reports against their own dependencies decide where fixes are needed.

Quick check

Sources

• CISA Coordinated Vulnerability Disclosure process

Last reviewed: 19 October 2026.