Reporting Vulnerabilities and Security Incident Leads

You can report potential vulnerabilities and security incident leads to Huawei PSIRT by email.

Reporting Suspected Vulnerabilities and Security Incident Leads

If you encounter or find a suspected vulnerability or security incident lead in Huawei products, you are encouraged to promptly report it to Huawei PSIRT.

• We define a vulnerability as a product security issue that can be exploited. Once exploited by an attacker, it can compromise the product's integrity, availability, or confidentiality. A vulnerability is not equivalent to a quality defect. A quality defect is one that, when the triggering conditions are met, will be triggered without the need for an attacker to exploit it. In contrast, a vulnerability must be exploited by an attacker in order to be triggered. We reserve the right to adjust this definition as appropriate in specific circumstances.
• Security incident leads refer to the signs and indicators of attacks that you observe, which may be related to Huawei products and are about to occur, are occurring, or have already occurred. Timely sharing of such information helps us respond quickly to protect customer networks.

Huawei adheres to the principle of responsible disclosure and handling to help customers mitigate network risks and prevent risk escalation caused by improper information disclosure. Huawei encourages security researchers to report suspected vulnerabilities and security incident leads through the security mechanisms defined in Huawei's vulnerability and security incident reporting channels.

Vulnerability Reporting Channels

Please report suspected vulnerabilities and security incident leads via email using this template. Huawei PSIRT will promptly confirm receipt of any suspected vulnerabilities and security incident leads reported by security researchers, industry organizations, customers, and suppliers. To encourage vulnerability reporting, Huawei has established a Bug Bounty Program.

Security Mechanism

Vulnerability information and security incidents are sensitive. To ensure confidentiality, you are advised to encrypt the information sent to psirt@huawei.com using Pretty Good Privacy (PGP). You can click here to obtain Huawei's PGP public key (key ID 0x0071F1F7; PGP fingerprint: 80E2 606E CF00 3E22 83EC D315 13BE 0776 0071 F1F7).

Throughout the vulnerability and security incident handling process, Huawei PSIRT strictly ensures that vulnerability information is shared only among personnel handling vulnerabilities and security incidents. We sincerely request you to keep the information confidential until a complete solution is available to our customers.

Response Scope

Huawei PSIRT is dedicated to receiving all security vulnerabilities and incidents related to Huawei products, solutions and services.

To obtain technical support for issues about Huawei products (such as issues regarding product configuration, how to obtain patches, and live-network vulnerability fixing), please contact Huawei Technical Assistance Center (TAC).

If you are our Carrier Business customer, click here.

If you are our Enterprise Business customer, click here.

If you are our Consumer Business customer, click here.

If you are our Digital Power customer, click here.

If you are our Huawei Cloud customer, click here.

If you are our HiSilicon customer, click here.

Updated 2026.9.15