Vulnerabilities are typically fixed, and then reported.

Reported to whom? In this case, it's the cloud provider itself.