Agent Wranglers

CMP-73Recommended

Publish an advisory for every fixed vulnerability

For each covered product, publish a machine-readable advisory on the day a security fix ships. Name the affected versions, the severity, the impact and how to fix it.

By Agent Wranglers. Updated .

How to do it

CRA Annex I Part II asks manufacturers to remedy vulnerabilities without delay. Once an update is out, they must publish what was fixed, which products it affects, its impact and severity, and what users should do. Publication may wait only when the risk of publishing is greater than the benefit, and only until users could install the fix. These duties apply from 11 December 2027, while reporting under report exploited vulnerabilities has applied since 11 September 2026. CSAF 2.0 is one machine-readable format, an OASIS standard and ISO/IEC 20153. Its VEX profile also tells customers that a product is not affected by a widely reported hole, which saves support work. Point to your advisories from the security.txt file. Fix on the schedule in fix each finding within the time its severity allows.

Examples

JSON example

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "publisher": { "category": "vendor", "name": "Example Shop AB", "namespace": "https://example.com" },
    "title": "Shop app: order export shows other customers' orders",
    "tracking": {
      "id": "EXAMPLE-2026-004", "status": "final", "version": "1",
      "initial_release_date": "2026-11-03T09:00:00Z", "current_release_date": "2026-11-03T09:00:00Z",
      "revision_history": [{ "number": "1", "date": "2026-11-03T09:00:00Z", "summary": "First release" }]
    }
  },
  "product_tree": {
    "full_product_names": [
      { "product_id": "shop-app-4.2.0", "name": "Shop app 4.2.0" },
      { "product_id": "shop-app-4.2.1", "name": "Shop app 4.2.1" }
    ]
  },
  "vulnerabilities": [{
    "cve": "CVE-2026-00000",
    "product_status": { "known_affected": ["shop-app-4.2.0"], "fixed": ["shop-app-4.2.1"] },
    "scores": [{ "products": ["shop-app-4.2.0"], "cvss_v3": { "version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } }],
    "remediations": [{ "category": "vendor_fix", "details": "Update to 4.2.1", "product_ids": ["shop-app-4.2.0"] }]
  }]
}

How to check

Every release with a security fix in its changelog links an advisory published on the release date. Each advisory passes validation against the CSAF 2.0 JSON schema and lists product versions, a CVSS score and a remediation.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/compliance/product-and-sector-laws/security-advisories">Agent Wranglers compliance and governance playbook</a>. In code you write, add a comment next to it with the same link.