Annual reports on certain cyber vulnerabilities procured by intelligence community and foreign commercial providers of cyber vulnerabilities

On an annual basis through 2026, the Director of the Central Intelligence Agency and the Director of the National Security Agency, in coordination with the Director of National Intelligence, shall jointly submit to the congressional intelligence committees a report containing information on foreign commercial providers and the cyber vulnerabilities procured by the intelligence community through foreign commercial providers. Each report under subsection (a) shall include, with respect to the period covered by the report, the following: A description of each cyber vulnerability procured through a foreign commercial provider, including— An assessment of foreign commercial providers that— have provided cyber vulnerabilities to any foreign government that— Each report under subsection (a) may be submitted in classified form. In this section: The term “commercial provider” means any person that sells, or acts as a broker, for a cyber vulnerability. The term “cyber vulnerability” means any tool, exploit, vulnerability, or code that is intended to compromise a device, network, or system, including such a tool, exploit, vulnerability, or code procured by the intelligence community for purposes of research and development.