Ge Vernova Vulnerability Disclosure

generated: '2026-09-12'
method: searched
probe: true
source: https://www.gevernova.com/security
policy:
  - https://www.gevernova.com/security
contact:
  - https://www.gevernova.com/security
bug_bounty: null
note: >-
  GE Vernova runs a coordinated vulnerability disclosure program at the corporate level, routed by
  business unit. Reports are submitted through a contact form on https://www.gevernova.com/security
  rather than to a published security@ address, and there is no bug bounty (no HackerOne, Bugcrowd
  or Intigriti program was found) and no /.well-known/security.txt on any GE Vernova host — the
  path returns 404 on gevernova.com and www.gevernova.com and 401 on the support portal. Publishing
  an RFC 9116 security.txt pointing at the existing policy page would be a one-file change that
  makes a program they already run machine-discoverable.
commitments:
  acknowledgement: within one business day of receipt
  triage: >-
    During initial triage GE Vernova's Cybersecurity team may request additional information,
    communicate the expected triage process and timeline, or notify the reporter that the report is
    out of scope.
  disclosure: >-
    Findings and process are communicated back to the reporter after assessment; the reporter's name
    is included in the final report on request when it results in a public disclosure.
  requested_from_reporters:
    - report in English
    - affected products including model/serial number, geography, software version, and how the product was obtained
    - proof-of-concept code and explanation where one exists
    - any knowledge of in-field exploitation
    - how the vulnerability was discovered, impact/CVSS view, potential remediations
    - reporter identity or an explicit request to remain anonymous
    - preferred contact method during triage
    - intentions regarding public disclosure
advisories:
  - business_unit: Electrification Software
    url: https://www.gevernova.com/software/cybersecurity
  - business_unit: Grid Solutions / Electrification
    url: https://www.gevernova.com/electrification/security-advisories
  - business_unit: Gas Power
    url: https://www.gevernova.com/gas-power/products/digital-and-controls/cybersecurity/security-advisories
  - business_unit: Steam Power
    url: https://www.gevernova.com/steam-power/services/automation-controls/cyber/security-advisories
evidence:
  - source: https://www.gevernova.com/security
    kind: disclosure page
    status: 200
    keywords:
      - coordinated vulnerability disclosure
      - responsible disclosure
      - security researcher
      - report a vulnerability
  - source: https://www.gevernova.com/.well-known/security.txt
    kind: security.txt
    status: 404
    note: not served
  - source: https://www.gevernova.com/software/cybersecurity
    kind: product security program
    status: 200
    keywords: [penetration testing, secure development, IEC 62443-4-1, security bulletins and advisories]