Since CVEs are centralised by MITRE, which is part of the US department of homeland security, I was wondering if some CVEs could be purposefully "delayed" before being communicated or even hidden from the public to allow the US intelligence services to exploit it before it is corrected.

  • It's not "can they", it's "how much do they" you need to ask.
    – dandavis
    Commented Oct 4, 2016 at 21:18

2 Answers 2


It is very clear that governments (not just the USA) do indeed make use of known vulnerabilities. I doubt that, at least the majority, of CVE's are deliberately delayed other than the delay that is typically offered to the vendor to allow them to fix the issue before public release. CVE's are reported from a wide variety of sources and wouldn't easily be intercepted by governments.

However, there is a rather bigger issue in that there are 3rd parties who offer vulnerability bounties of $m's for provable exploits. These are far larger than the bug bounties typically offered by vendors. The vulnerabilities are often sold to governments and not released publicly.


They could, but it's unlikely. The primary reason for this is that the CVE will eventually be published and (hopefully) fixed by the vendor. This would only give a small window of opportunity to use the vulnerability. Obviously not taking into account the long lead time between patch release and installation.

Much better to develop or buy them directly and use them without releasing any information, which could tip off potential targets.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .