Coordinated Vulnerability Disclosure (CVD).

A process in which a vulnerability finder, the affected vendor, and sometimes a coordinator agree on a timeline before publicly disclosing security flaws. It belongs to the Attacks & Threats category of cybersecurity.

A process in which a vulnerability finder, the affected vendor, and sometimes a coordinator agree on a timeline before publicly disclosing security flaws.

Coordinated Vulnerability Disclosure (CVD), often called responsible disclosure, structures how researchers report flaws and how vendors respond. Typical steps are: private report to a security contact, acknowledgement and triage, agreement on a remediation timeline (often 60 to 90 days), patch release, then public advisory with a CVE identifier and credit to the researcher. National CERTs, CISA, and platforms such as HackerOne can act as neutral coordinators when communication is difficult. Compared with full disclosure, CVD reduces the time defenders are exposed while still motivating vendors to fix issues. Effective programs require a published security contact, a clear policy, safe-harbour language, and realistic SLAs.

Defences for Coordinated Vulnerability Disclosure (CVD) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: CVD, Responsible disclosure.