Mobile and Web Application Vulnerabilities

Caterpillar looks forward to working with the security research community to find potential vulnerabilities and keep our businesses and customers safe. If you believe that you have information about a potential cybersecurity vulnerability related to Caterpillar or our affiliates, please submit it through https://Hackerone.com/Caterpillar

Construction or Mining Equipment, Engines, Gas Turbine and Diesel-Electric Locomotive Related Vulnerabilities

The above machinery is not included in the Bugcrowd program, but vulnerabilities affecting machinery can be submitted thru the following process. Please include the following information in an attached document to the email:

• Details of the vulnerability, including the type of vulnerability 
• Information needed to reproduce and validate the vulnerability, including Proof of Concept code used for exploit; 
• Perceived impact(s) of issue, including how an attacker could exploit the issue; 
• Any additional contact information we may need; and 
• Any other pertinent details. 

We strongly recommend that submitters encrypt the attachments containing the requested information above via PGP. Caterpillar’s public PGP key can be found here. You should receive a confirmation of receipt within 72 hours. If for some reason you do not receive such a response, please follow up with us to ensure that we received your original message.

Click here to submit an equipment, engine, turbine or locomotive related vulnerability

You should receive a confirmation of receipt within 72 hours. If for some reason you do not receive such a response, please follow up with us to ensure that we received your original message.

We value the positive impact of your work and thank you for notifying Caterpillar of this matter.

Issues that are considered out of scope for equipment, engine, turbine or locomotive submissions (including but not limited to):

• Physical configuration issues 
• Facility security gaps 
• Phishing attacks
• Equipment damage through physical harm 
• Operational efficiency issues