Cybersecurity glossary
What is Coordinated Vulnerability Disclosure (CVD)?
Learn what Coordinated Vulnerability Disclosure (CVD) is, how researchers and vendors work together on fixes, and why clear policies reduce harm from vulnerability discovery.
Definition
Coordinated Vulnerability Disclosure (CVD) is a process where security researchers and vendors share vulnerability details privately long enough to develop and distribute fixes—then disclose publicly in a way that minimizes user harm while enabling defensive action.
Why coordinated disclosure matters
Publicly dumping a zero-day with no fix available can punish users. Hiding problems forever protects vendors’ pride, not customers. Coordinated Vulnerability Disclosure (CVD) sits between those extremes: private remediation first, informed public disclosure after.
Good CVD builds trust with researchers, shrinks exploit windows, and turns adversarial discovery into a managed risk event.
Roles in a CVD process
Finder / reporter
Discovers the issue, documents impact, and reports through an approved channel.
Vendor / maintainer
Triages, fixes, tests, and prepares advisories and patches for users.
Coordinator
CERTs or brokers help when multiple vendors or supply-chain parties are affected.
Deployers
Consume advisories, assess exposure, and apply patches or mitigations promptly.
Typical CVD timeline
Private report
Researcher submits technical details via security@, portal, or bug bounty platform.
Triage and validation
Vendor confirms reproducibility, severity, and affected versions.
Fix development
Engineers patch, add tests, and prepare rollout plans without public tipping.
Coordinated release
Advisory, CVE (if used), and updates ship; partners may receive early notice.
Post-disclosure support
Monitor exploitation, answer deployers, and improve root-cause defenses.
Disclosure approaches compared
| Approach | Core idea | Main risk if misused |
|---|---|---|
| Full CVD | Private fix window then joint or timed public release | Vendors delaying indefinitely without communication |
| Full disclosure immediate | Publish details as soon as found | Users exposed before patches exist |
| Non-disclosure | Keep the issue secret forever | Attackers may already know; users stay unpatched |
| Soft disclosure | High-level warning first, details later | Ambiguity that delays defensive action |
CVD readiness checklist
- Publish a vulnerability disclosure policy with scope and safe harbor.
- Provide a monitored intake channel with encryption options for sensitive reports.
- Define triage SLAs and a severity model reporters can understand.
- Practice multi-party coordination for shared libraries and OEM products.
- Prepare advisory templates, CVE assignment workflow, and customer notification paths.
- Avoid punishing good-faith researchers with legal threats.
- Track metrics: time-to-triage, time-to-fix, and repeat root causes.
- Feed every CVD case into SSDLC improvements so the same class does not recur.
The practical takeaway
Coordinated Vulnerability Disclosure (CVD) is how the industry turns discovered weaknesses into patched systems with less collateral damage. It needs clear policies, responsive triage, and honest timelines—not silence or theatrics.
If researchers cannot find a safe way to tell you, they may tell the world—or tell no one while attackers already know. Make coordination the easy path.
Related security terms
Vulnerability Management
How organizations prioritize and remediate issues after they are known.
Patch Management
Rolling out fixes once a coordinated disclosure produces updates.
Vulnerability Exploitability eXchange (VEX)
Communicating whether a component vulnerability is actually exploitable in a product.
Secure Software Development Lifecycle (SSDLC)
Lifecycle practices that reduce vulnerabilities needing disclosure.
Application Security (AppSec)
Program capabilities needed to triage and fix reported issues.
Frequently asked questions
What is CVD in simple terms?
A researcher privately tells the vendor about a bug, the vendor fixes it, and then both sides publish carefully so users can protect themselves without giving attackers a long free head start.
Is CVD the same as a bug bounty?
Bug bounties are incentive programs. CVD is the coordination process. Many bounties use CVD principles, but CVD also happens without payment.
How long should a vendor get before public disclosure?
Common norms are around 90 days, adjusted for severity, exploit status, and fix complexity. Policies should state expectations upfront.
What if a vendor ignores a report?
Researchers may escalate to CERTs/CSIRTs or disclose after the stated deadline. Silence is why published disclosure policies and intake SLAs matter.
Should every detail be published on disclosure day?
Publish enough for defenders to detect and patch. Withhold weaponizing specifics if users are not yet protected, and update as patches propagate.
What is a vulnerability disclosure policy (VDP)?
A public statement of how to report issues, what is in scope, legal safe harbor for good-faith research, and how the organization will respond.
Does CVD apply to open-source maintainers?
Yes. Maintainers need private reporting channels, triage capacity, and coordinated release notes just like commercial vendors.
References
Explore authoritative guidance and frameworks related to coordinated vulnerability disclosure (cvd).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.