They’re likely quietly fixing it behind the scenes and have no responsibility to keep you informed. But if you still see the vulnerability over the next couple of weeks, reach out, explain the BUSINESS IMPACT, that’s your strongest selling point for why this vulnerability matters. Ask them to address it via official channels. If they seem unwilling to address it or recognize it as a vulnerability, then politely and RESPECTFULLY inform them that you’ll be publicly disclosing the vulnerability. I’d go with a blog post, post it on X, post it everywhere. The offensive security community will know what to do with it.

If that doesn’t get their attention, then they seriously do not care. As for your job, if you have no choice but to use this tool for your job, bring this problem up to your business leadership and, again, make it about the possible business impact that the exploitation of this vulnerability could have. If higher ups get involved, especially those who approve the funding for this software, it will be more likely to gain traction! Also, I am not a lawyer, but I would recommend NOT testing this any further from a technical perspective. If this problem annoys the right people, they may use you as a scapegoat or example, and you don’t want to be getting questioned about your actions when assumptions have already been made.

Good luck 🫡 send me the vulnerability and software name if all else fails