New CISA-hosted VINCE-NT system revealed for coordinated vulnerability disclosure

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced the launch of Vulnerability Information and Coordination Environment – New Technology (VINCE-NT) on Thursday, an upgraded, fully CISA-hosted system that will replace the original VINCE for coordinated vulnerability disclosure (CVD).

VINCE has been used by researchers, suppliers and stakeholders since 2020 to coordinate the disclosure of cybersecurity vulnerabilities, and was originally sponsored by CISA and hosted by Carnegie Mellon University’s CERT Coordination Center (CERT/CC) under its Software Engineering Institute.

The new VINCE-NT system, officially live as of Sept. 17, 2026, is now fully sponsored, hosted and managed by CISA and includes several improvements to streamline CVD, the agency said in an FAQ.

The new reporting system is said to have a more user-friendly interface with clearer reporting fields that makes submitting reports “easier” and “safer,” and VINCE-NT also uses automation to improve the advisory publication workflow.

Related reading:

CISA also highlights enhanced triage capabilities, built-in tools for more secure communication and file sharing, advanced reporting of case metrics to better inform CISA’s CVD team and better support for “seamless collaboration” between researchers, suppliers and cybersecurity defenders.

SC Media reached out to a CISA spokesperson for more information about VINCE-NT’s security improvements and use of automation, but did not receive a response by time of publication.

In its announcement, CISA stated current users of VINCE should update their internal reporting procedures to reflect their use of the new VINCE-NT system. Current active VINCE cases are planned to be transitioned to VINCE-NT within the coming weeks, while historical case data is expected to remain available within the legacy VINCE system “for the foreseeable future,” CISA said.

VINCE-NT also includes changes to the terminology used and the vulnerability status information included in advisories. VINCE-NT uses the standardized terms “supplier,” “component” and “reporter” to refer to vendors/developers/maintainers, products and researchers/finders, respectively.

Additionally, VINCE-NT will support vulnerability status information that aligns more closely with the Common Security Advisory Framework (CSAF) and Common Vulnerabilities and Exposures (CVE) Record Format, which is “more specific and formal” than the Vendor Information included in legacy VINCE Vulnerability Notes.

CISA emphasized that while VINCE-NT is now housed directly by the agency, it remains separate from the Vulnerability Disclosure Policy (VDP) Platform that is focused on vulnerability report intake by federal civilian executive branch (FCEB) agencies.

“VINCE-NT is a tool designed to support the CVD process by facilitating collaboration and communication between industry stakeholders involved in addressing vulnerabilities which may receive a CVE ID,” the agency clarified.