Security Advisory Template (CSAF 2.0, VEX)

Security Advisory: [Advisory ID] [Short title]

Public security advisory for one or more vulnerabilities in your products, written so that every section maps to the OASIS Common Security Advisory Framework (CSAF) Version 2.0 (OASIS Standard, 18 November 2022, with Errata 01, January 2024): document metadata, product tree, vulnerabilities, product status, remediations and scores, plus threats, flags and notes. The human-readable advisory and the machine-readable CSAF file are produced from the same content. A VEX status statement follows the CISA Minimum Requirements for VEX (April 2023). Severity uses FIRST CVSS v4.0, referred to by name only. Replace every [bracketed] value and every row marked Example. The worked example is a fictional advisory from Corvid Commerce, a fictional SaaS company, for its on-premises point-of-sale agent and its hosted storefront.

Document control

Approvals

Revision history

Contents

• 1. Summary
• 2. Document metadata
• 3. Product tree
• 4. Vulnerabilities
• 5. Product status
• 6. VEX status statement
• 7. Remediations
• 8. Scores, threats and severity
• 9. Disclosure timeline and acknowledgments
• 10. Machine-readable publication
• 11. Pre-publication checklist
• 12. Glossary and references
• Standard and licence note

1. Summary

Example summary text: Corvid Commerce has released updates for Corvid POS Agent for Windows that fix a privilege escalation vulnerability in the local update service. A user who can log on to the point-of-sale terminal with a standard account could run code with SYSTEM privileges. Remote exploitation is not possible without first obtaining local access. Customers should install version 5.3.3 or 5.2.8. Customers who use the hosted storefront only, or the Linux agent, do not need to act.

2. Document metadata

2.1 Publisher and distribution

2.2 Notes

CSAF notes carry the human-readable narrative. Use one note per purpose, with the categories the standard defines.

2.3 References

3. Product tree

3.1 Branches

The product tree is a hierarchy of branches ending in full product names. A common pattern is vendor, then product name, then product version or version range.

3.2 Full product names

CSAF 2.0 product identification helpers include CPE, PURL, hashes, model numbers, serial numbers, SKUs, SBOM URLs and generic URIs. Prefer PURL or CPE because scanners match on them.

3.3 Product groups and relationships

CSAF 2.0 relationship categories are default_component_of, external_component_of, installed_on, installed_with and optional_component_of.

4. Vulnerabilities

4.1 Vulnerability overview

4.2 Description

VULN-1 (Example). The update service of Corvid POS Agent for Windows runs with SYSTEM privileges and loads a helper library from a directory that standard users can write to. A local user who places a crafted library in that directory can cause the service to run it on the next update check. The attacker needs a valid local account on the terminal; no network access to the terminal is needed beyond that. Successful exploitation gives full control of the terminal, including access to cached transaction data not yet synchronised.

VULN-2 (Example). ExampleTLS 3.1.4, which ships inside Corvid POS Agent 5.3.0 to 5.3.2, contains a flaw in TLS session resumption. Corvid POS Agent does not enable session resumption, so the vulnerable code is not executed; see section 6.

4.3 Involvements

CSAF 2.0 involvement statuses are completed, contact_attempted, disputed, in_progress, not_contacted and open.

5. Product status

Meaning of the CSAF 2.0 status lists, in short:

The lists form four contradiction groups (affected, not affected, fixed, under investigation) that must not share a product ID within one vulnerability. In the VULN-1 row, CSAFPID-0002 and CSAFPID-0004 sit in both first_fixed and fixed (same group), and CSAFPID-0004 and CSAFPID-0005 also appear in recommended, which is outside the groups: the row passes the test.

6. VEX status statement

6.1 Statements

6.2 Justification labels

The five justification labels in CSAF 2.0 flags match those defined in the CISA document VEX Status Justifications (June 2022) and used by OpenVEX: component_not_present, vulnerable_code_not_present, vulnerable_code_not_in_execute_path, vulnerable_code_cannot_be_controlled_by_adversary and inline_mitigations_already_exist. Use the last two only with strong evidence, because they rely on reasoning about attacker control and mitigation strength that later research often overturns. Never use "not affected" when the customer must apply a configuration change to be safe: that is "affected" with a workaround.

If you also publish a standalone VEX document (CSAF document category csaf_vex, CycloneDX or OpenVEX), keep the statuses identical and reference this advisory. The SBOM and VEX Policy (security/sbom-vex-policy) sets the evidence and approval rules for VEX statements.

7. Remediations

CSAF 2.0 remediation categories are vendor_fix, workaround, mitigation, no_fix_planned and none_available. The restart categories are none, vulnerable_component, service, parent, dependencies, connected, machine, zone and system; choose the narrowest one that is true.

Customer action by group (Example)

8. Scores, threats and severity

8.1 CVSS

CSAF 2.0 scores objects support CVSS version 2.0 and 3.x only. Until your tooling supports CSAF 2.1 (whose committee drafts replace scores with metrics and add CVSS v4.0, EPSS and SSVC), you have two options: publish a CVSS v3.1 score in the scores object and give the CVSS v4.0 vector and score in a note of category details; or publish CVSS v4.0 only in the human-readable advisory. Record which option you use in your PSIRT procedure so that every advisory is consistent. Score the vulnerability in the product's default, supported configuration and say so.

8.2 Threats and exploitation

Update the exploit_status threat and republish if exploitation is later observed or the CVE is added to the CISA Known Exploited Vulnerabilities catalogue. Readers may also use EPSS probabilities or an SSVC decision (see the CISA SSVC guide) to prioritise; you may reference them but should not replace your own severity with them.

8.3 Aggregate severity

The aggregate severity (/document/aggregate_severity) summarises the advisory for readers who look at one value. Set it to the highest qualitative rating among affected products, using a namespace that names your scale. Example: High, namespace https://corvid.example/security/severity.

9. Disclosure timeline and acknowledgments

Where an obligation to notify an authority applies (for example actively exploited vulnerabilities under Article 14 of the EU Cyber Resilience Act, Regulation (EU) 2024/2847, reportable since 11 September 2026; check the consolidated text), follow the CRA Vulnerability Handling and Reporting Procedure (security/cra-vulnerability-handling). The advisory is not a substitute for that notification.

10. Machine-readable publication

10.1 Publication rules

10.2 CSAF skeleton

The excerpt shows the main structure for two of the affected and fixed Windows versions. It is illustrative: the full advisory also needs the remaining products, the VULN-2 entry, flags and threats, so generate the real document with a CSAF tool rather than by hand and validate it.

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "publisher": { "category": "vendor", "name": "Corvid Commerce", "namespace": "https://corvid.example" },
    "title": "Privilege escalation in Corvid POS Agent update service",
    "distribution": { "tlp": { "label": "WHITE" } },
    "tracking": {
      "id": "CORVID-SA-2026-007",
      "status": "final",
      "version": "1.0.0",
      "initial_release_date": "2026-10-24T09:00:00.000Z",
      "current_release_date": "2026-10-24T09:00:00.000Z",
      "revision_history": [ { "number": "1.0.0", "date": "2026-10-24T09:00:00.000Z", "summary": "Initial release" } ]
    },
    "notes": [ { "category": "summary", "text": "Corvid Commerce has released Corvid POS Agent 5.3.3 to fix a local privilege escalation in the update service." } ]
  },
  "product_tree": {
    "branches": [ {
      "category": "vendor", "name": "Corvid Commerce",
      "branches": [ {
        "category": "product_name", "name": "Corvid POS Agent for Windows",
        "branches": [
          { "category": "product_version_range", "name": "vers:generic/>=5.3.0|<=5.3.2", "product": { "product_id": "CSAFPID-0003", "name": "Corvid POS Agent for Windows 5.3.0 to 5.3.2" } },
          { "category": "product_version", "name": "5.3.3", "product": { "product_id": "CSAFPID-0004", "name": "Corvid POS Agent for Windows 5.3.3" } }
        ]
      } ]
    } ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-YYYY-NNNNN",
      "product_status": { "known_affected": ["CSAFPID-0003"], "first_fixed": ["CSAFPID-0004"], "fixed": ["CSAFPID-0004"], "recommended": ["CSAFPID-0004"] },
      "remediations": [ { "category": "vendor_fix", "details": "Install Corvid POS Agent 5.3.3", "product_ids": ["CSAFPID-0003"] } ],
      "scores": [ { "products": ["CSAFPID-0003"], "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" } } ]
    }
  ]
}

The CVE ID and the Example CVSS v3.1 vector (7.8, High) must be replaced with your own values; the mandatory tests reject a vector, score and severity that do not agree. vers: range names in product_version_range follow the CSAF 2.0 recommendation; a plain description such as "5.3.0 to 5.3.2" is also allowed but tools cannot evaluate it.

11. Pre-publication checklist

12. Glossary and references

12.1 Glossary

12.2 References

Standard and licence note

Structure aligned with the OASIS Common Security Advisory Framework Version 2.0 (Copyright OASIS Open 2022 to 2024; the OASIS notice permits derivative works that comment on or assist in implementing the specification); section names, field paths and enumerated values are cited so that the template maps to the standard, and no specification text is reproduced. Based on the CISA Minimum Requirements for VEX (April 2023), a work of the United States Government. CVSS is owned by FIRST (Forum of Incident Response and Security Teams, Inc.); it is referred to by name and version only, and readers should use the official specification and calculator at first.org. The text of this template is original. CSAF 2.1 was at committee draft stage at the time of writing: check the current official versions at oasis-open.org, cisa.gov and first.org before relying on this template. Template licence: MIT.