Troubleshooting Table

1. The vendor has been given an opportunity to review the report
2. The vendor informs the reporter of its decision not to take any further action

Assuming both conditions above have been met, the validation and triage phase has concluded, and the vendor has indicated that they will not be engaging in the remediation phase.

The reporter's implied obligation to the vendor coordination process is effectively terminated at this point. Assuming the reporter chooses to continue pursuing the issue at all, their options include:

• The reporter may publish the report on their own.
• The reporter may attempt to engage a coordinator

Discovery

Reporting

Validation and Triage

Remediation

1. The vulnerability is still under embargo (i.e., the process has not reached the Public Awareness phase yet).
2. Evidence indicates that the vulnerability is being used by attackers.

See 6.6 Active Exploitation

At this point, the embargo is effectively moot, and the Public Awareness phase is initiated regardless of whether the preceding phases have completed.

Vendors, Coordinators, and Reporters should always be ready to immediately terminate an embargo and go public with whatever advice is available at the time that evidence of exploitation becomes known.

The Vendor should accelerate their remediation development as much as possible.

Even a simple Vendor acknowledgement that the problem is being worked on can help deployers adjust their response accordingly.

1. The reporter has made reasonable attempts through multiple channels to reach the vendor
2. The reporter has been unable to confirm that the vendor has received the report

See Finding Vendor Contacts for tips on how to reach vendors. See also 6.1 Unable to Find Vendor Contact and 6.2 Unresponsive Vendor.

Assuming the reporter chooses to continue pursuing the issue at all, their options include:

• The reporter may publish the report on their own. Hard-to-reach vendors often become less so after a vulnerability or two is made public without their involvement.
• The reporter may attempt to engage a coordinator, to continue trying to reach the vendor

Reporting

Validation and Triage

Remediation

Public Awareness

1. The reporter and vendor had already been in contact about the vulnerability.
2. The reporter has repeatedly attempted to communicate with the vendor.
3. The vendor has been non-responsive for at least two weeks
4. Either of the following events has occurred:
   1. An already-agreed embargo date has passed, or
   2. No embargo date was set and at least six weeks have elapsed since the vendor's last response.

See also 6.3 Somebody Stops Replying.

At this point, the CERT/CC would consider the vendor to be non-responsive.

Assuming the reporter chooses to continue pursuing the issue at all, their options include:

• The reporter may publish the report on their own. If so, the reporter should provide a courtesy copy of the report to the vendor with a few days' lead time to give the vendor one last chance to prepare for entering the Public Awareness phase.
• The reporter may attempt to engage a coordinator

Reporting

Validation and Triage

Remediation

Public Awareness

1. The reporter and vendor had already been in contact about the vulnerability.
2. The vendor has repeatedly attempted to communicate with the reporter.
3. The reporter has not responded to the vendor.

See also 6.3 Somebody Stops Replying.

The vendor is under no obligation to continue attempting to engage with a reporter who stops responding.

The vendor should continue through the Validation and Triage, Remediation, and Public Awareness phases on their own as necessary.

If the report was received in the context of a bug bounty program, the vendor should apply their bug bounty policy as appropriate.

Reporting

Validation and Triage

Remediation

1. The vendor had received the report.
2. The vendor is working on it.
3. Information about the vulnerability appears in public.

At this point, the embargo is effectively moot, and the Public Awareness phase is initiated regardless of whether the preceding phases have completed.

Vendors, Coordinators, and Reporters should always be ready to immediately terminate an embargo and go public with whatever advice is available at the time that the vulnerability becomes known.

The Vendor should accelerate their remediation development as much as possible.

Even a simple Vendor acknowledgement that the problem is being worked on can help deployers adjust their response accordingly.

The CERT/CC does not recommend punitive measures be taken against perceived "leakers". Vendors are of course free to choose with whom they cooperate in the future.

1. The vendor was unaware of the vulnerability at the time it became public.
   
   

The main defenses Vendors have against being surprised by public reports of vulnerabilities in their products are:

• Vendors should have a mechanism for receiving vulnerability reports and a process for resolving them
• Vendors should strive to maintain a reputation for cooperating with Finders and Reporters
• Vendors should design, evaluate, and test their own products as extensively as they are able to.

Reporting

Validation and Triage

Remediation

1. The vendor had received a report of a vulnerability
2. The vendor received a second, seemingly independent, report of the same vulnerability

Vulnerability rediscovery is known to happen. It's usually not a big deal if the Reporters are cooperating with the Vendor.

Vendors should attempt to verify that the second report is in fact independent of the first, and not simply a case of the same report taking diverse paths to reach the vendor.

Vendors should re-evaluate any existing embargo and consider accelerating the Remediation and Public Awareness phases in light of the apparent ease with which the vulnerability is being independently found.

Vendors should ensure any relevant bug bounty policies define how this situation will be handled with respect to bounty payouts.