Verizon Vulnerability Disclosure

generated: '2026-08-04'
method: searched
probe: true
source: https://www.verizon.com/solutions-and-services/report-security-vulnerability/
policy:
  - https://www.verizon.com/solutions-and-services/report-security-vulnerability/
  - https://hackerone.com/verizon-wireless
contact:
  - networksecurityincidentresponsemailbox@verizonwireless.com
  - vecirt-incident@verizon.com
  - phishing@verizon.net
security_txt: absent
cve_numbering_authority: true
advisories:
  - name: Verizon CVE advisories (CNA)
    url: https://github.com/verizon/cve
    note: >-
      Verizon is a CVE Numbering Authority and publishes the advisories it issues in
      this GitHub repository.
  - name: Verizon Security Advisories (managed-service customers)
    url: https://www.verizon.com/business/support/vec/service-management/verizon-security-advisories/
    note: Customer-facing advisory dashboard for managed devices with known vulnerabilities.
routing:
  - scope: Verizon website, product or service vulnerability
    channel: networksecurityincidentresponsemailbox@verizonwireless.com
  - scope: Network / infrastructure incident
    channel: vecirt-incident@verizon.com
  - scope: Phishing
    channel: phishing@verizon.net
bug_bounty:
  platform: HackerOne
  handle: verizon-wireless
  url: https://hackerone.com/verizon-wireless
  bounties: unknown
  note: >-
    hackerone.com/verizon-wireless resolves 200 and is the Verizon Wireless
    Vulnerability Disclosure Policy program page; the page is client-rendered so
    scope, launch date and bounty status could not be read anonymously. A second
    handle, hackerone.com/verizon, is a private program (404 anonymously).
safe_harbor: false
safe_harbor_note: >-
  Verizon publishes an explicit anti-testing statement rather than a safe-harbor
  clause: "Verizon does not endorse, solicit, or request independent testing of
  Verizon services and products for security vulnerabilities." Reporters are asked
  to keep unverified findings confidential until Verizon has investigated.
pgp: absent
evidence:
  - source: https://www.verizon.com/solutions-and-services/report-security-vulnerability/
    kind: disclosure page
    http_status: 200
    keywords: [report security vulnerability, responsible disclosure, confidentiality]
  - source: https://hackerone.com/verizon-wireless
    kind: bug bounty platform program
    http_status: 200
  - source: https://github.com/verizon/cve
    kind: CNA advisory repository
    http_status: 200
  - source: https://www.verizon.com/business/support/vec/service-management/verizon-security-advisories/
    kind: customer security advisories
    http_status: 200
x-evidence:
  fetched: '2026-08-04'
  note: >-
    Supersedes the 2026-07-11 file, whose only evidence was the verizon.com
    homepage. No /.well-known/security.txt exists on any Verizon host (see
    well-known/verizon-well-known.yml).