What CISA, Project Zero and the CVE Program Say Happens Between Flaw Report and Advisory

A software flaw can pass through several hands before the public sees it. A researcher or vendor reports it, a coordinator checks it, the software maker ships a fix, and a numbered record appears. Timing varies from step to step, and some of it is set by published program policies.

The public notice comes near the end of the process. The earlier steps can set when a fix must exist and when technical details may be published. The steps below follow the process as CISA, Google’s Project Zero and the CVE program describe it.

Intake and Triage at CISA

CISA’s coordinated vulnerability disclosure process starts when a researcher, supplier or other party reports a suspected flaw to CISA through VINCE-NT, the agency’s CVD platform. The CVD team then checks whether the report seems valid, can be acted on, falls within CVD scope, is already known to the vendor or the public, and meets coordination criteria.

Federal law gives CISA authority to receive vulnerability information, under 6 U.S.C. 659(c)(12). Reports that fall outside scope are closed or referred to a better-suited organization or vendor, and the reporter is directed there. In-scope cases move into coordination.

CVD is separate from CISA’s Vulnerability Disclosure Process (VDP), which covers reports about an organization’s own public-facing assets. A VDP involves no coordination, remediation or advisory publication.

In coordination, CISA identifies and contacts the supplier, analyzes the technical details, obtains vendor confirmation and tracks the timeline. When needed, CISA mediates between reporter and vendor, and it drafts publication-ready advisory language.

CISA’s contacts are [email protected], [email protected] and 1-844-Say-CISA.

The 90-Day Clock
Project Zero’s policy gives a vendor 90 days after notification to make a patch available. If a patch ships within that window, technical details are published 30 days after the patch.

Fix Windows in Project Zero’s Policy

Google’s Project Zero publishes its own policy, which starts its clock when it notifies a vendor. The vendor has 90 days after that notice to make a patch available. If a patch ships within the window, technical details are published 30 days after the patch.

The policy’s examples show a patch on day 47 leading to publication on day 77, and a patch on day 83 leading to publication on day 113. If no patch is ready, details are published when the 90 days end. A vendor that will patch within 104 days may request a grace period, and details are then published 120 days after the vulnerability was initially disclosed. Project Zero and a vendor may also agree to publish earlier than the policy dates.

Bugs under active exploitation follow a faster track. The policy applies it when Project Zero finds evidence of exploitation against real users. A 7-day deadline replaces the 90-day policy. If a patch ships by the end of day 7, the 30-day publication window still applies. The policy sets a grace period of 3 days for in-the-wild vulnerabilities, and details for patches released in that period are still published 30 days after the original deadline, which is day 37.

The two tracks produce very different dates. A standard bug with no patch has its details published at day 90. An exploited bug’s details can appear by day 37, including for patches released during the grace period.

Where a CVE Identifier Comes From

A CVE identifier is assigned by a CVE Numbering Authority, or CNA, rather than by a single office. Under the CVE program’s CNA rules, a CNA may assign an ID only to a vulnerability within its scope, and only when it intends to make that vulnerability public. It may not give a new ID to a vulnerability that already has one. When it assigns an ID to a reported flaw, it must pass the ID to the reporter, subject to any embargo rules.

The rules also require a CNA to provide lists of unused reserved IDs when requested. The program’s Secretariat rejects unused IDs through an annual process. When a vulnerability is made public, the CNA submits the CVE entry to the Secretariat, and should do so within 24 hours of publishing the ID. That 24-hour timing is a recommendation rather than a requirement.

Other duties include publishing a scope definition and a disclosure policy, making a reasonable effort, when it assigns an ID, to notify the maintainer of the affected code, and keeping a public distribution point for in-scope disclosures. A CNA must not assign IDs for products or services that are neither owned by the CNA nor customer-controlled.

In CISA’s process, the agency decides whether a case receives a CVE ID and which CNA will publish the record. CISA may serve as the authoring CNA when appropriate, and its CVD program carries out CNA of Last Resort responsibilities.

Project Zero and CISA start their clocks from different events.

The Public Advisory and Its Timing

The final CISA steps are agreement and release. CISA and case participants settle the advisory text, the publication date and how the supplier’s and the researcher’s disclosure plans line up. Public disclosure may include a CVE Record, a comprehensive vulnerability advisory, and/or associated public messaging, and the reporter and vendor are notified of publication.

CSAF documents are machine-readable advisories in the OASIS CSAF 2.0 standard. CISA publishes them for its IT and OT advisories through a GitHub repository.

Afterward, the case is evaluated for the Known Exploited Vulnerabilities catalog. That catalog is CISA’s authoritative source of vulnerabilities exploited in the wild, and organizations should use it as an input to their vulnerability management prioritization framework.

CISA’s disclosure timing may depend on whether the flaw has been publicly disclosed or is actively exploited, its potential impact on critical infrastructure, national security or public health, vendor responsiveness, and whether mitigations are available and, if not, how long the vendor needs to create them.

If a vendor is unresponsive or will not establish a reasonable timeframe for remediation, CISA may disclose as early as 45 days after its first attempt to contact the vendor, even without a patch.

Project Zero’s clock runs from notification, while CISA’s early-disclosure figure runs from the first contact attempt.

CISA also takes part in the Vulnerability Equities Process. Under Section 5.4 of that charter, vulnerabilities reported through CVD are not subject to VEP adjudication.

Reading a Public Notice by Its Dates

A public notice may show a CVE identifier and an advisory. Its dates can be checked against the policy clocks. Under Project Zero’s policy, the publication date of a detailed write-up falls 30 days after a patch that ships within the 90-day window, so the patch date determines the publication date.

The policy’s examples make the arithmetic concrete. A patch on day 47 points to a write-up on day 77. A patch on day 83 points to day 113, which falls after the 90-day mark because the write-up waits 30 days after the patch.

Notices for actively exploited bugs run on the 7-day track. Their publication date still falls 30 days after the patch, as long as the patch arrives by day 7. A patch released in the 3-day grace period is published on day 37.