Generally no, there is minimal liability attached to acknowledging a report. There may be internal political issues and definitely external media ones, though.

Generally no, there is minimal liability attached to acknowledging a report. There may be internal political issues and definitely external media ones, though. Nobody wants to be the person who says "We're vulnerable, but I don't care enough to fix it". That's how you get internal political battles. Denial solves that problem. When dealing with external reports, it means ammunition for dealing with third parties. "We are not aware of any such vulnerabilities" becomes a defensible position, as does telling reporters that you dispute the claims of vulnerability. Those buy time to maybe fix something. And, well, there's the CYA psychology too. Nobody wants to confront the idea that they, or their smart and hard-working coworkers, screwed up to the point of creating a significant vulnerability.