--- title: "Publish an advisory for every fixed ยท Agent Wranglers" url: https://agentwranglers.se/playbook/compliance/security-laws/security-advisories id: CMP-73 level: Recommended applies: digital-product region: EU updated: 2026-10-27 build: a2a6bdfed830 tokens: 1465 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Publish an advisory for every fixed vulnerability For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Security laws](https://agentwranglers.se/playbook/compliance/security-laws.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. - ID: CMP-73 - Level: Recommended - Chapter: [Security laws](https://agentwranglers.se/playbook/compliance/security-laws.md) - Rule: For each covered product, publish a machine-readable advisory on the day a security fix ships. Name the affected versions, the severity, the impact and how to fix it. - Check: Every release with a security fix in its changelog links an advisory published on the release date. Each advisory passes validation against the CSAF 2.0 JSON schema and lists product versions, a CVSS score and a remediation. - Applies when: The project sells or hands out software or devices that others run, not only a hosted service. - Region: European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds. - How: CRA Annex I Part II asks manufacturers to remedy vulnerabilities without delay. Once an update is out, they must publish what was fixed, which products it affects, its impact and severity, and what users should do. Publication may wait only when the risk of publishing is greater than the benefit, and only until users could install the fix. These duties apply from 11 December 2027, while reporting under [report exploited vulnerabilities](https://agentwranglers.se/playbook/compliance/security-laws/cra-vulnerability-reporting.md) has applied since 11 September 2026. CSAF 2.0 is one machine-readable format, an OASIS standard and ISO/IEC 20153. Its VEX profile also tells customers that a product is not affected by a widely reported hole, which saves support work. Point to your advisories from the [security.txt file](https://agentwranglers.se/playbook/website/standard-addresses/security-txt.md). Fix on the schedule in [fix each finding within the time its severity allows](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/fix-deadlines.md). ## Examples **Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses. ### JSON example ```json { "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "publisher": { "category": "vendor", "name": "Example Shop AB", "namespace": "https://example.com" }, "title": "Shop app: order export shows other customers' orders", "tracking": { "id": "EXAMPLE-2026-004", "status": "final", "version": "1", "initial_release_date": "2026-11-03T09:00:00Z", "current_release_date": "2026-11-03T09:00:00Z", "revision_history": [{ "number": "1", "date": "2026-11-03T09:00:00Z", "summary": "First release" }] } }, "product_tree": { "full_product_names": [ { "product_id": "shop-app-4.2.0", "name": "Shop app 4.2.0" }, { "product_id": "shop-app-4.2.1", "name": "Shop app 4.2.1" } ] }, "vulnerabilities": [{ "cve": "CVE-2026-00000", "product_status": { "known_affected": ["shop-app-4.2.0"], "fixed": ["shop-app-4.2.1"] }, "scores": [{ "products": ["shop-app-4.2.0"], "cvss_v3": { "version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } }], "remediations": [{ "category": "vendor_fix", "details": "Update to 4.2.1", "product_ids": ["shop-app-4.2.0"] }] }] } ``` ## Sources - [Cyber Resilience Act Annex I Part II on vulnerability handling](https://eur-lex.europa.eu/eli/reg/2024/2847/oj) - [CSAF Version 2.0, OASIS Standard](https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html) ## Related rules - CMP-49 [Report exploited vulnerabilities in your products](https://agentwranglers.se/playbook/compliance/security-laws/cra-vulnerability-reporting.md) in Compliance and governance - WEB-143 [Tell people how to report a hole](https://agentwranglers.se/playbook/website/standard-addresses/security-txt.md) in Website - APS-81 [Fix each finding within the time its severity allows](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/fix-deadlines.md) in Application security - DOC-14 [Keep a dated changelog for users with deprecations and security fixes in their own sections](https://agentwranglers.se/playbook/documentation/reference-and-changelogs/changelog-deprecations-security.md) in Documentation - IOT-37 [Make every report and advisory name the model and firmware version](https://agentwranglers.se/playbook/connected-devices/support-and-vulnerability-reports/model-and-version.md) in Connected devices - OSS-26 [Publish an advisory that tools can read](https://agentwranglers.se/playbook/open-source/vulnerabilities-and-advisories/machine-readable-advisory.md) in Open source maintenance **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers compliance and governance playbook`. In code you write, add a comment next to it with the same link. - Previous: [Handle vulnerabilities for the whole support period](https://agentwranglers.se/playbook/compliance/security-laws/cra-support-period.md) - Next: [Prepare the technical file and CE marking](https://agentwranglers.se/playbook/compliance/security-laws/cra-technical-file.md) - [Security laws](https://agentwranglers.se/playbook/compliance/security-laws.md)