# VER-RPT-VDT — Vulnerability Details

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /requirement/ver-rpt-vdt

Vulnerability Evaluation and Reporting (`VER`) · group all · subset RPT
Force: MUST

## Statement

Providers MUST include the following information (if applicable) on detected vulnerabilities when reporting on vulnerability detection and response activity, UNLESS it is an accepted vulnerability:

## Who it binds

- Providers

## Certification classes

_Applies regardless of certification class._

## Which certifications it binds

Certification type: 20x, Rev5
Path: Program, Agency

## Machine-readable form

FedRAMP Vulnerability Detail Report (VER-RPT-VDT) — https://fedramp.gov/schemas/fedramp-vulnerability-detail-report-schema-2026-06-24.json

## Artifacts

- {"text":"A recent vulnerability report or a sample vulnerability report","scope":"all","class":null,"source":"requirement"}

## Timeframes

_This requirement states no deadline._

## Notifications

_This requirement demands no notification._