Nineteen-year-old cybersecurity researcher Nisarga Adhikary has been recognised by the US Department of Justice (DoJ) after reporting a vulnerability in one of the department's law enforcement systems.
Adhikary shared the development on X on September 22, posting a screenshot of the DoJ's acknowledgements page, which lists researchers who have responsibly disclosed valid vulnerabilities to the department.
The recognition follows a vulnerability report Adhikary submitted to the US department. Speaking to India Today Tech, he said he had identified what he described as a “critical vulnerability in one of their largest law enforcement systems”.
He has not disclosed the specific system involved or technical details of the vulnerability.
“I reported the vulnerability roughly a week ago; they validated and patched this within a week and credited me on their Hall of Fame/acknowledgements page,” Adhikary told the publication. He also said he was not paid for reporting the flaw.
Adhikary said he discovered the vulnerability while browsing the department's website and using custom scripts to identify potential weaknesses.
From CBSE's marking portal to US government systems
The recognition comes a few months after Adhikary came into the spotlight in India for his disclosures about CBSE's On-Screen Marking (OSM) system.
In February, he reported multiple vulnerabilities in the portal to CERT-In, India's nodal agency for responding to cybersecurity incidents. He later published his findings in May, alleging that weaknesses in the system could allow unauthorised access to examiner accounts and other sensitive information.
On May 31, CBSE said vulnerabilities in the portal had been contained and announced that an expert team involving cybersecurity professionals from government agencies and IITs had been deployed to secure the system. The board also thanked ethical hackers and citizens who had flagged the issues.
What happened after the CBSE disclosure?
The CBSE episode brought Adhikary to the attention of IIT Kanpur Director Manindra Agrawal.
In June, IIT Kanpur appointed him as an Open-Source Intelligence (OSINT) and Threat Intelligence Engineer at C3iHub, the institute's cybersecurity technology innovation hub. His role involves analysing information from publicly available sources and identifying vulnerabilities in websites and applications.
Agrawal said he contacted Adhikary after reading his CBSE disclosure and described him as “a talented young engineer with significant potential”.
He has also reported vulnerabilities in other systems. CERT-In has credited him with three vulnerabilities in an enterprise resource planning system, including a remote-code-execution vulnerability, an insecure direct object reference flaw and an information-disclosure vulnerability. The agency published the vulnerabilities under CVE identifiers CVE-2026-84147, CVE-2026-84148 and CVE-2026-84149.
US military vulnerability also reported
The DoJ recognition is not the only US government-related vulnerability Adhikary says he has reported.
He told that he had also identified a vulnerability in a US Department of Defense or military system. According to him, the vulnerability was validated by the authorities, although remediation was still underway. He said he had received a “Thanks” from the US Department of Defense through HackerOne.