CISA Issues Guidance for Coordinated Vulnerability Disclosure Programs

• •CISA and four international agencies released guidance for software vendors on CVD programs.
• •The guidance aims to enhance vulnerability management and product security.
• •Clear processes for reporting vulnerabilities are essential for effective CVD programs.

On July 16, 2026, CISA and four international cybersecurity agencies released guidance urging software vendors to establish coordinated vulnerability disclosure (CVD) programs. This initiative aims to improve vulnerability management and product security by fostering structured engagement with security researchers. The guidance outlines how organizations can create public programs for receiving and responding to vulnerability reports. CISA emphasizes that a well-defined CVD program helps assess risks and strengthens product security. The guidance aligns with CISA's Secure by Design initiative, promoting transparency and responsibility among technology providers. Experts highlight the importance of clear processes for reporting vulnerabilities and maintaining communication with researchers. The guidance follows a recent incident where a security researcher struggled to report a significant issue to CISA itself.