General Electric Healthcare
By GE HealthCare Vulnerability disclosure program on Self-hosted gehealthcare.com
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 1
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Replies within 4 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Response
-
Within 4 days
We will acknowledge receipt of your message within four (4) business days;
- Hall of fame
-
Yes
We will provide public recognition for the security researcher (if requested) and if the report results in a public disclosure.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
1 asset you may test, 2 excluded.
Products and areas 1
- all GE HealthCare commercially available products
Out of scope (2)
- operating systems and other third-party components
- products or network infrastructure in clinical settings or other active environments
Rules
What the policy asks of you, and the bug types it won't reward, quoted from General Electric Healthcare's policy. "We" in these lines means the program, not this site.
While testing
-
Comply with all applicable laws and regulations of your location and the location in which the GE HealthCare product is located;
-
Do not engage in research or testing of systems where there is any risk of patient harm;
-
Any product intended for subsequent use in a clinical setting should be returned to its original state when testing is concluded. Contact GE HealthCare for Service Assistance;
-
Do not disclose vulnerability details to the public before a mutually agreed-upon timeframe with GE HealthCare has expired;
-
Do not operate outside of the scope described in this document; and
-
Do provide us with details of communication to regulatory organizations or other third parties about any discovered vulnerability, without delay.
Not accepted
-
Vulnerabilities in operating systems and other third-party components should not be reported via this process.
-
Do not use this channel to report complaints about GE products currently in use.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.