we won't disclose this vulnerability because we don't have a patch, even though we know there's an exploit available. This is some 1984 shit. It

we won't disclose this vulnerability because we don't have a patch, even though we know there's an exploit available. This is some 1984 shit. It's a horrible policy. While yes it'll make it easier for bad actors to write exploits, it'll also allow for sys-admins to possibly mitigate those exploits, or add extra logging to make it easier to catch exploits. Not admitting your software has flaws until you fix them is beyond irresponsible.