What is coordinated vulnerability disclosure?
Coordinated vulnerability disclosure (CVD) is the practice of a security researcher privately reporting a vulnerability to the organisation responsible for it, giving that organisation a reasonable window to investigate and fix the issue before any public details are released.
It exists as a middle path between two extremes: disclosing nothing at all, which leaves the vulnerability unfixed and users unprotected, and disclosing everything immediately, which can hand attackers a working blueprint before a fix exists. CVD aims to get vulnerabilities fixed quickly while keeping exploit details out of public view until a patch is available.
A typical disclosure timeline
Timelines vary by severity and by organisation, but most coordinated disclosure processes follow a similar shape:
- Day 0 — Report receivedA researcher submits a report through a private channel, including reproduction steps and impact assessment.
- Day 1–5 — TriageThe report is validated, severity is assessed, and the researcher receives acknowledgement.
- Day 5–45 — RemediationThe affected organisation develops and tests a fix. Timelines are typically negotiated based on severity.
- Day 45–90 — Patch releaseA fix ships to affected users. A public advisory is drafted.
- Day 90+ — Public disclosureTechnical details are published, with credit to the reporting researcher.
90 days is a commonly used default ceiling, after which details may be disclosed regardless of whether a fix exists — this pressure is part of what keeps the process moving.
Who's involved
The researcher
Finds and reports the vulnerability, typically in exchange for credit, and sometimes a bounty. Expected to withhold public details until the agreed disclosure date.
The vendor / organisation
Investigates the report, develops a fix, and communicates progress back to the researcher. Expected to respond within a reasonable window rather than going silent.
The coordinator
An independent third party — like this resource — that can facilitate communication when a direct researcher-to-vendor relationship breaks down, help assign a CVE identifier, and maintain a public record once a disclosure is complete.
Glossary
- CVE
- Common Vulnerabilities and Exposures — a standardised identifier for a publicly known vulnerability.
- Embargo
- The agreed period during which vulnerability details are kept private ahead of public disclosure.
- Zero-day
- A vulnerability being actively exploited before a fix is available.
- Bug bounty
- A monetary reward program for researchers who responsibly report vulnerabilities.
- Full disclosure
- Publishing vulnerability details immediately, without a coordination period.
- Patch Tuesday
- An informal term for a vendor's regular, scheduled security-update release day.
Public disclosure log
A record of disclosures coordinated through this resource, published once the embargo period has ended. Organisation names are withheld until the affected party confirms public release.
RECENT ENTRIES
| Date | Sector | Severity | Status |
|---|
Frequently asked questions
Is UKCert a government body?
No. UKCert is an independent, privately maintained reference resource. It has no statutory or regulatory authority and is not affiliated with any government agency, including the NCSC.
Can I report a vulnerability here?
This page is an informational reference, not an intake system. If you've found a vulnerability, look for the affected organisation's own published disclosure policy first.
Why do disclosure timelines vary?
Severity, complexity of the fix, and how many downstream systems are affected all change how long remediation reasonably takes.
What happens if a vendor doesn't respond?
Most coordination frameworks build in an escalation path and, eventually, a disclosure deadline that applies regardless of vendor response.