Talos Responsible Disclosure Policy Update
Summary: Cisco Talos announced changes to its Vendor Vulnerability Reporting and Disclosure Policy, including a new step where a vulnerability report is also supplied to Carnegie Mellon CERT if a vendor remains unresponsive forty-five days after initial contact, after which the vendor gets roughly forty-five more days before public disclosure. Talos reported an overall average of 78 days to patch across vendors, with lagging commercial vendors dragging the average down from about 40 days, while large consumer-software vendors with public security stances and active bug-bounty programs matched Open Source responsiveness and one Open Source vendor delivered a same-day fix.
Why it matters: The 78-day average to patch, pulled up from roughly 40 by lagging commercial vendors, is the window in which a known vulnerability can be exploited before a fix exists - and Talos notes that if a white hat team found the flaw, adversaries may already be trying to exploit it.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026