Uncoordinated Vulnerability Disclosure: The Continuing Issues with CVD

The document is an opinion and analysis from ZDI on the breakdowns in coordinated vulnerability disclosure (CVD), highlighting poor vendor communication on report acknowledgement, severity disputes, patch timelines, and researcher credit. It underscores the risk to defenders when CVSS disagreements and opaque processes delay remediation, citing recent Microsoft-related scrutiny as context. To promote better practices, ZDI introduces the Vanguard Awards to recognize vendors demonstrating transparency, collaboration, and timely patching.