# Security Advisory: [Advisory ID] [Short title]

> Public security advisory for one or more vulnerabilities in your products, written so that every
> section maps to the OASIS Common Security Advisory Framework (CSAF) Version 2.0 (OASIS Standard, 18
> November 2022, with Errata 01, January 2024): document metadata, product tree, vulnerabilities,
> product status, remediations and scores, plus threats, flags and notes. The human-readable advisory
> and the machine-readable CSAF file are produced from the same content. A VEX status statement
> follows the CISA *Minimum Requirements for VEX* (April 2023). Severity uses FIRST CVSS v4.0,
> referred to by name only. Replace every `[bracketed]` value and every row marked *Example*. The
> worked example is a fictional advisory from Corvid Commerce, a fictional SaaS company, for its
> on-premises point-of-sale agent and its hosted storefront.

<!--
Guidance: How to use this template
- One advisory per coordinated release. Several CVEs fixed in the same release can share one
  advisory; unrelated issues should not.
- Fill in this order: product tree (3), vulnerabilities (4), product status (5), VEX statement (6),
  remediations (7), scores (8). Write the summary (1) last, from the facts below it.
- Use product IDs (CSAFPID-NNNN) consistently: every status, remediation, score and flag refers to
  them. A product that appears in the tree but in no status list is a defect.
- Keep the advisory factual. Do not include exploit code or step-by-step reproduction; describe
  impact and preconditions instead.
- Common pitfall: listing only the fixed version. Customers need to see every affected range, the
  first fixed version per branch, and which products are not affected.
-->

## Document control

<!-- Guidance: These fields map to CSAF /document and /document/tracking. Keep the tracking ID stable for the life of the advisory; change the version on every revision. -->

| Field | Value | CSAF 2.0 path |
|---|---|---|
| Advisory ID | [CORVID-SA-2026-007] | `/document/tracking/id` |
| Title | [Privilege escalation in Corvid POS Agent update service] | `/document/title` |
| Document category | [csaf_security_advisory] | `/document/category` |
| CSAF version | 2.0 | `/document/csaf_version` |
| Version | [1.0.0] | `/document/tracking/version` |
| Status | [Draft / Interim / Final] | `/document/tracking/status` |
| Initial release date | YYYY-MM-DDThh:mm:ssZ | `/document/tracking/initial_release_date` |
| Current release date | YYYY-MM-DDThh:mm:ssZ | `/document/tracking/current_release_date` |
| Publisher | [Corvid Commerce Product Security (vendor)] | `/document/publisher` |
| Owner | [@psirt-lead] | Internal |
| Approvers / reviewers | [@head-of-product-security], [@product-owner], [@legal], [@communications] | Internal |
| Last updated | YYYY-MM-DD | Internal |
| Classification | [Public after release; Confidential until then] | Internal |
| Traffic Light Protocol | [WHITE] | `/document/distribution/tlp/label` |
| Language | [en] | `/document/lang` |
| Aggregate severity | [High] | `/document/aggregate_severity/text` |
| Related | [PSIRT case ID], [CVE IDs], [release notes], [SBOM URL] | `/document/references` |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Head of product security | [@name] | [Approved / Changes requested] | YYYY-MM-DD |
| Product owner | [@name] | [Decision] | YYYY-MM-DD |
| Legal | [@name] | [Decision] | YYYY-MM-DD |
| Communications | [@name] | [Decision] | YYYY-MM-DD |

### Revision history

<!-- Guidance: This table becomes /document/tracking/revision_history. Every published change gets a row, including a status change from Interim to Final. -->

| Version | Date | Author | Change summary |
|---|---|---|---|
| 1.0.0 | YYYY-MM-DD | [@name] | *Example:* Initial public release |
| 1.1.0 | YYYY-MM-DD | [@name] | *Example:* Added fixed version for the 5.2 long-term support branch |
| 1.1.1 | YYYY-MM-DD | [@name] | *Example:* Corrected CWE identifier; no change to affected products |

## Contents

- [1. Summary](#1-summary)
- [2. Document metadata](#2-document-metadata)
- [3. Product tree](#3-product-tree)
- [4. Vulnerabilities](#4-vulnerabilities)
- [5. Product status](#5-product-status)
- [6. VEX status statement](#6-vex-status-statement)
- [7. Remediations](#7-remediations)
- [8. Scores, threats and severity](#8-scores-threats-and-severity)
- [9. Disclosure timeline and acknowledgments](#9-disclosure-timeline-and-acknowledgments)
- [10. Machine-readable publication](#10-machine-readable-publication)
- [11. Pre-publication checklist](#11-pre-publication-checklist)
- [12. Glossary and references](#12-glossary-and-references)
- [Standard and licence note](#standard-and-licence-note)

## 1. Summary

<!-- Guidance: Answer five questions in plain language for a busy administrator: what is affected, how bad it is, is it exploited, what to do, by when. This text becomes the CSAF note with category "summary". -->

| Item | Value |
|---|---|
| Affected products | *Example:* Corvid POS Agent 5.3.0 to 5.3.2 and 5.2.0 to 5.2.7 on Windows |
| Not affected | *Example:* Corvid POS Agent 5.4.0 and later; Corvid POS Agent for Linux; Corvid Storefront (hosted) |
| Impact | *Example:* A local, low-privileged user on the till can gain SYSTEM privileges |
| Severity | *Example:* High (CVSS v4.0 base score in section 8) |
| Exploitation | *Example:* No exploitation known at publication |
| Action | *Example:* Update to 5.3.3 or 5.2.8; workaround in section 7 if you cannot update within 7 days |
| CVE | *Example:* CVE-YYYY-NNNNN |

*Example* summary text: Corvid Commerce has released updates for Corvid POS Agent for Windows that
fix a privilege escalation vulnerability in the local update service. A user who can log on to
the point-of-sale terminal with a standard account could run code with SYSTEM privileges. Remote
exploitation is not possible without first obtaining local access. Customers should install
version 5.3.3 or 5.2.8. Customers who use the hosted storefront only, or the Linux agent, do not
need to act.

## 2. Document metadata

<!-- Guidance: Metadata decides whether tools can process the advisory at all. Use the vendor publisher category when you publish about your own products; coordinators and researchers use other categories. -->

### 2.1 Publisher and distribution

| Element | Value | Notes |
|---|---|---|
| Publisher category | [vendor] | Allowed values in CSAF 2.0: coordinator, discoverer, other, translator, user, vendor |
| Publisher name | [Corvid Commerce] | Same spelling in every advisory |
| Publisher namespace | [https://corvid.example] | A URL the publisher controls; identifies the publisher across documents |
| Contact details | [security@corvid.example] | Where readers send questions |
| Issuing authority | [Corvid Commerce PSIRT] | Optional free text |
| TLP label | [WHITE] | CSAF 2.0 uses the TLP version 1 labels (WHITE, GREEN, AMBER, RED); TLP 2.0 CLEAR corresponds to WHITE |
| Distribution text | [Public] | Optional statement on sharing |

### 2.2 Notes

CSAF notes carry the human-readable narrative. Use one note per purpose, with the categories the
standard defines.

| Note category | Title | Content |
|---|---|---|
| summary | Summary | The summary text from section 1 |
| description | Vulnerability description | Per vulnerability, in section 4 |
| details | Technical details | Preconditions, affected component, attack surface (no exploit code) |
| faq | Frequently asked questions | *Example:* "Does the hosted storefront need an update? No: it does not run the agent." |
| legal_disclaimer | Terms of use | [Your standard advisory disclaimer, approved by Legal] |
| general | Support status | *Example:* "Version 5.1 reached end of security support on YYYY-MM-DD and will not be updated." |

### 2.3 References

| Category | Summary | URL |
|---|---|---|
| self | Human-readable advisory | [https://corvid.example/security/advisories/corvid-sa-2026-007] |
| self | CSAF document | [https://corvid.example/.well-known/csaf/white/2026/corvid-sa-2026-007.json] |
| external | Release notes 5.3.3 | [URL] |
| external | SBOM for 5.3.3 | [URL] |
| external | CVE record | [https://www.cve.org/CVERecord?id=CVE-YYYY-NNNNN] |

## 3. Product tree

<!-- Guidance: Describe products the way customers identify them in their asset inventory. Use the same PURL or CPE as your SBOMs so that VEX and SBOM data correlate automatically. -->

### 3.1 Branches

The product tree is a hierarchy of branches ending in full product names. A common pattern is
vendor, then product name, then product version or version range.

```mermaid
flowchart TD
  V["vendor: Corvid Commerce"] --> P1["product_name: Corvid POS Agent for Windows"]
  V --> P2["product_name: Corvid POS Agent for Linux"]
  V --> P3["product_name: Corvid Storefront"]
  P1 --> A["product_version: 5.2.0 to 5.2.7"]
  P1 --> B["product_version: 5.2.8"]
  P1 --> C["product_version: 5.3.0 to 5.3.2"]
  P1 --> D["product_version: 5.3.3"]
  P1 --> E["product_version: 5.4.0"]
  P2 --> F["product_version: 5.4.0"]
  P3 --> G["product_version: hosted service"]
```

### 3.2 Full product names

| Product ID | Full product name | Identification helper | Notes |
|---|---|---|---|
| CSAFPID-0001 *(Example)* | Corvid POS Agent for Windows 5.2.0 to 5.2.7 | CPE `cpe:2.3:a:corvid:pos_agent:*:*:*:*:*:windows:*:*` with version range | Long-term support branch |
| CSAFPID-0002 *(Example)* | Corvid POS Agent for Windows 5.2.8 | PURL `pkg:generic/corvid/pos-agent-windows@5.2.8` | Fixed on the support branch |
| CSAFPID-0003 *(Example)* | Corvid POS Agent for Windows 5.3.0 to 5.3.2 | Version range | Current branch, affected |
| CSAFPID-0004 *(Example)* | Corvid POS Agent for Windows 5.3.3 | PURL `pkg:generic/corvid/pos-agent-windows@5.3.3`; SBOM URL | Fixed |
| CSAFPID-0005 *(Example)* | Corvid POS Agent for Windows 5.4.0 | PURL `pkg:generic/corvid/pos-agent-windows@5.4.0` | Never affected (service redesigned) |
| CSAFPID-0006 *(Example)* | Corvid POS Agent for Linux 5.4.0 | PURL `pkg:generic/corvid/pos-agent-linux@5.4.0` | Does not contain the update service |
| CSAFPID-0007 *(Example)* | Corvid Storefront (hosted) | Service name | SaaS, operated by Corvid |
| CSAFPID-0008 *(Example)* | ExampleTLS 3.1.4 (third-party library) | PURL `pkg:generic/exampletls@3.1.4` | Component for the VEX statement |
| [ID] | [Name] | [CPE, PURL, hash, SBOM URL, model or serial number] | [Notes] |

CSAF 2.0 product identification helpers include CPE, PURL, hashes, model numbers, serial numbers,
SKUs, SBOM URLs and generic URIs. Prefer PURL or CPE because scanners match on them.

### 3.3 Product groups and relationships

| Element | ID | Members or relationship | Use |
|---|---|---|---|
| Product group | CSAFGID-0001 *(Example)* | CSAFPID-0001, CSAFPID-0003 | "All affected Windows versions", used in remediations |
| Relationship | CSAFPID-0009 *(Example)* | ExampleTLS 3.1.4 (CSAFPID-0008) default component of Corvid POS Agent for Windows 5.3.0 to 5.3.2 (CSAFPID-0003) | Lets the VEX statement in section 6 name the library inside the product |

CSAF 2.0 relationship categories are default_component_of, external_component_of, installed_on,
installed_with and optional_component_of.

## 4. Vulnerabilities

<!-- Guidance: One block per vulnerability. Describe the weakness, the preconditions and the impact precisely enough that a defender can decide exposure, and no further. -->

### 4.1 Vulnerability overview

| Field | VULN-1 *(Example)* | VULN-2 *(Example)* | CSAF 2.0 path |
|---|---|---|---|
| Title | Privilege escalation in update service | ExampleTLS session resumption flaw | `/vulnerabilities[]/title` |
| CVE | CVE-YYYY-NNNNN | CVE-YYYY-MMMMM | `/vulnerabilities[]/cve` |
| CWE | CWE-427 Uncontrolled Search Path Element | [CWE assigned by the library maintainer] | `/vulnerabilities[]/cwe` |
| Other IDs | CORVID-PSIRT-0412 | Upstream advisory ID | `/vulnerabilities[]/ids` |
| Discovery date | YYYY-MM-DD | YYYY-MM-DD | `/vulnerabilities[]/discovery_date` |
| Release date | YYYY-MM-DD | YYYY-MM-DD | `/vulnerabilities[]/release_date` |
| Reported by | External researcher (credited in section 9) | Library maintainer | `/vulnerabilities[]/acknowledgments` |

### 4.2 Description

**VULN-1 *(Example)*.** The update service of Corvid POS Agent for Windows runs with SYSTEM
privileges and loads a helper library from a directory that standard users can write to. A local
user who places a crafted library in that directory can cause the service to run it on the next
update check. The attacker needs a valid local account on the terminal; no network access to the
terminal is needed beyond that. Successful exploitation gives full control of the terminal,
including access to cached transaction data not yet synchronised.

**VULN-2 *(Example)*.** ExampleTLS 3.1.4, which ships inside Corvid POS Agent 5.3.0 to 5.3.2, contains a
flaw in TLS session resumption. Corvid POS Agent does not enable session resumption, so the
vulnerable code is not executed; see section 6.

### 4.3 Involvements

| Vulnerability | Party | Status | Date | Summary |
|---|---|---|---|---|
| VULN-1 *(Example)* | vendor | completed | YYYY-MM-DD | Fix released for both supported branches |
| VULN-1 *(Example)* | discoverer | completed | YYYY-MM-DD | Researcher confirmed the fix |
| VULN-2 *(Example)* | vendor | completed | YYYY-MM-DD | Analysis complete: not affected |

CSAF 2.0 involvement statuses are completed, contact_attempted, disputed, in_progress,
not_contacted and open.

## 5. Product status

<!-- Guidance: This is the heart of the advisory. For each vulnerability, every product ID the vulnerability concerns should belong to exactly one status group: affected (first_affected, known_affected, last_affected), not affected (known_not_affected), fixed (first_fixed, fixed) or under investigation. CSAF 2.0 mandatory test 6.1.6 rejects a product in two of these groups. A product may appear in both first_fixed and fixed, and recommended may overlap any group. Use under_investigation honestly while analysis continues, then update the advisory. -->

| Vulnerability | known_affected | first_affected | last_affected | first_fixed | fixed | recommended | known_not_affected | under_investigation |
|---|---|---|---|---|---|---|---|---|
| VULN-1 *(Example)* | CSAFPID-0001, CSAFPID-0003 | | | CSAFPID-0002, CSAFPID-0004 | CSAFPID-0002, CSAFPID-0004 | CSAFPID-0004, CSAFPID-0005 | CSAFPID-0005, CSAFPID-0006, CSAFPID-0007 | |
| VULN-2 *(Example)* | | | | | | | CSAFPID-0009 | |
| [VULN-n] | [IDs] | [IDs] | [IDs] | [IDs] | [IDs] | [IDs] | [IDs] | [IDs] |

Meaning of the CSAF 2.0 status lists, in short:

| Status list | Use it for |
|---|---|
| known_affected | Product versions confirmed vulnerable |
| first_affected, last_affected | The boundary versions of an affected range, when you express ranges by endpoints |
| first_fixed | The first version on a branch that contains the fix |
| fixed | Every version that contains the fix, including later ones |
| recommended | The version you advise customers to install |
| known_not_affected | Product versions confirmed not vulnerable (requires a flag or an impact statement, section 6) |
| under_investigation | Products still being analysed (no claim either way yet) |

The lists form four contradiction groups (affected, not affected, fixed, under investigation) that
must not share a product ID within one vulnerability. In the VULN-1 row, CSAFPID-0002 and
CSAFPID-0004 sit in both `first_fixed` and `fixed` (same group), and CSAFPID-0004 and CSAFPID-0005
also appear in `recommended`, which is outside the groups: the row passes the test.

## 6. VEX status statement

<!-- Guidance: The CISA minimum requirements for VEX need, for each product and vulnerability, one of four statuses. "Not affected" needs a justification or an impact statement; "affected" needs an action statement. Map them to CSAF flags, threats and remediations as shown. -->

### 6.1 Statements

| Statement ID | Product | Vulnerability | VEX status | Justification (not affected) | Impact or action statement | CSAF 2.0 encoding |
|---|---|---|---|---|---|---|
| VEX-001 *(Example)* | CSAFPID-0009 (ExampleTLS inside POS Agent 5.3.0 to 5.3.2) | VULN-2 | Not affected | Vulnerable code not in execute path | The agent configures ExampleTLS with session resumption disabled and offers no setting to enable it | Flag `vulnerable_code_not_in_execute_path`; threat category `impact` with the statement |
| VEX-002 *(Example)* | CSAFPID-0006 (Linux agent 5.4.0) | VULN-1 | Not affected | Component not present | The Linux agent has no update service; updates use the system package manager | Flag `component_not_present` |
| VEX-003 *(Example)* | CSAFPID-0007 (Storefront) | VULN-1 | Not affected | Component not present | The hosted service does not run the POS agent | Flag `component_not_present` |
| VEX-004 *(Example)* | CSAFPID-0005 (Windows agent 5.4.0) | VULN-1 | Not affected | Vulnerable code not present | Version 5.4.0 replaced the update service; the vulnerable loading code no longer exists | Flag `vulnerable_code_not_present` |
| VEX-005 *(Example)* | CSAFPID-0001, CSAFPID-0003 | VULN-1 | Affected | n/a | Update to 5.2.8 or 5.3.3; workaround in section 7 | Remediation `vendor_fix` and `workaround` |
| VEX-006 *(Example)* | CSAFPID-0002, CSAFPID-0004 | VULN-1 | Fixed | n/a | Contains the fix | Status `fixed`, `first_fixed` |

### 6.2 Justification labels

The five justification labels in CSAF 2.0 flags match those defined in the CISA document *VEX
Status Justifications* (June 2022) and used by OpenVEX:
component_not_present, vulnerable_code_not_present, vulnerable_code_not_in_execute_path,
vulnerable_code_cannot_be_controlled_by_adversary and inline_mitigations_already_exist. Use the last
two only with strong evidence, because they rely on reasoning about attacker control and mitigation
strength that later research often overturns. Never use "not affected" when the customer must apply
a configuration change to be safe: that is "affected" with a workaround.

If you also publish a standalone VEX document (CSAF document category `csaf_vex`, CycloneDX or
OpenVEX), keep the statuses identical and reference this advisory. The SBOM and VEX Policy
(`security/sbom-vex-policy`) sets the evidence and approval rules for VEX statements.

## 7. Remediations

<!-- Guidance: Tell each customer group exactly what to do. Separate the fix from temporary measures, state whether a restart is needed, and say when no fix is planned. -->

| Remediation ID | Vulnerability | Category | Products | Details | Restart required | URL |
|---|---|---|---|---|---|---|
| REM-001 *(Example)* | VULN-1 | vendor_fix | CSAFPID-0003 | Install Corvid POS Agent 5.3.3 | service | [Download URL] |
| REM-002 *(Example)* | VULN-1 | vendor_fix | CSAFPID-0001 | Install Corvid POS Agent 5.2.8 (long-term support branch) | service | [Download URL] |
| REM-003 *(Example)* | VULN-1 | workaround | CSAFGID-0001 | Remove write permission for standard users from the agent's update cache directory; this disables automatic updates until reverted | none | [Knowledge base URL] |
| REM-004 *(Example)* | VULN-1 | mitigation | CSAFGID-0001 | Restrict interactive logon on terminals to named staff accounts and enable application allow-listing | none | [Hardening guide URL] |
| REM-005 *(Example)* | VULN-1 | no_fix_planned | Corvid POS Agent 5.1.x (out of support) | Upgrade to a supported version | n/a | [Support policy URL] |

CSAF 2.0 remediation categories are vendor_fix, workaround, mitigation, no_fix_planned and
none_available. The restart categories are none, vulnerable_component, service, parent,
dependencies, connected, machine, zone and system; choose the narrowest one that is true.

**Customer action by group (*Example*)**

| Customer group | Action | Deadline we recommend |
|---|---|---|
| Retailers on 5.3.x with automatic updates | None; the update installs at the next maintenance window | Confirm within 7 days |
| Retailers on 5.3.x with managed updates | Approve 5.3.3 in the management console | 7 days |
| Retailers on 5.2.x long-term support | Install 5.2.8 | 14 days |
| Retailers on 5.1.x | Plan upgrade; apply REM-003 and REM-004 now | Immediately |
| Storefront-only customers | No action | n/a |

## 8. Scores, threats and severity

<!-- Guidance: Give the score and the vector so readers can recompute it in their environment. State the CVSS version and nomenclature. Do not copy metric descriptions from the CVSS specification: link to it. -->

### 8.1 CVSS

| Vulnerability | CVSS version | Nomenclature | Vector string | Score | Qualitative rating | Products |
|---|---|---|---|---|---|---|
| VULN-1 *(Example)* | 4.0 | CVSS-B (base only) | [CVSS:4.0/... vector from the FIRST calculator] | [Score] | [High] | CSAFPID-0001, CSAFPID-0003 |
| VULN-1 *(Example)* | 3.1 | Base | [CVSS:3.1/... vector] | [Score] | [High] | CSAFPID-0001, CSAFPID-0003 |
| VULN-2 *(Example)* | n/a | n/a | Not scored for this product (not affected) | n/a | n/a | CSAFPID-0009 |

CSAF 2.0 `scores` objects support CVSS version 2.0 and 3.x only. Until your tooling supports CSAF
2.1 (whose committee drafts replace `scores` with `metrics` and add CVSS v4.0, EPSS and SSVC), you
have two options: publish a CVSS v3.1 score in the `scores` object and give the CVSS v4.0 vector
and score in a note of category `details`; or publish CVSS v4.0 only in the human-readable
advisory. Record which option you use in your PSIRT procedure so that every advisory is consistent.
Score the vulnerability in the product's default, supported configuration and say so.

### 8.2 Threats and exploitation

| Vulnerability | Threat category | Details | Date | Products |
|---|---|---|---|---|
| VULN-1 *(Example)* | exploit_status | No public exploit and no exploitation known at publication | YYYY-MM-DD | CSAFGID-0001 |
| VULN-1 *(Example)* | impact | Full control of the terminal and cached transaction data | YYYY-MM-DD | CSAFGID-0001 |
| VULN-1 *(Example)* | target_set | Windows terminals where untrusted staff have interactive logon | YYYY-MM-DD | CSAFGID-0001 |
| VULN-2 *(Example)* | impact | Session resumption is disabled; the vulnerable code is not executed | YYYY-MM-DD | CSAFPID-0009 |

Update the exploit_status threat and republish if exploitation is later observed or the CVE is added
to the CISA Known Exploited Vulnerabilities catalogue. Readers may also use EPSS probabilities or
an SSVC decision (see the CISA SSVC guide) to prioritise; you may reference them but should not
replace your own severity with them.

### 8.3 Aggregate severity

The aggregate severity (`/document/aggregate_severity`) summarises the advisory for readers who
look at one value. Set it to the highest qualitative rating among affected products, using a
namespace that names your scale. *Example:* High, namespace `https://corvid.example/security/severity`.

## 9. Disclosure timeline and acknowledgments

<!-- Guidance: A short factual timeline builds trust and shows coordinated disclosure was followed. Credit reporters only with their consent and in the form they choose. -->

| Date | Event |
|---|---|
| YYYY-MM-DD *(Example)* | Report received through the vulnerability disclosure programme |
| YYYY-MM-DD | Report acknowledged (within 2 business days, per our disclosure policy) |
| YYYY-MM-DD | Vulnerability confirmed; CVE reserved |
| YYYY-MM-DD | Fix developed and tested on both supported branches |
| YYYY-MM-DD | Researcher reviewed the fix |
| YYYY-MM-DD | Coordinated public release of updates and this advisory |

| Acknowledged party | Organisation | Vulnerability | Summary |
|---|---|---|---|
| [Researcher name or handle] *(Example)* | [Organisation or independent] | VULN-1 | Reported the vulnerability and confirmed the fix |

Where an obligation to notify an authority applies (for example actively exploited vulnerabilities
under Article 14 of the EU Cyber Resilience Act, Regulation (EU) 2024/2847, reportable since 11
September 2026; check the consolidated text), follow the CRA Vulnerability Handling and Reporting
Procedure (`security/cra-vulnerability-handling`). The advisory is not a substitute for that
notification.

## 10. Machine-readable publication

<!-- Guidance: A CSAF file that nobody can find is not useful. Publish it where aggregators and customers' tools look, sign it and provide hashes. -->

### 10.1 Publication rules

| Rule | Practice |
|---|---|
| File name | Tracking ID in lower case, other characters replaced by underscores as the standard specifies, with `.json` extension; *Example:* `corvid-sa-2026-007.json` |
| Location | CSAF provider directory under `/.well-known/csaf/` with a `provider-metadata.json`; documents organised in folders by year of initial release (and by TLP label where several are used) |
| Integrity | At least one hash file per document with a secure algorithm (*Example:* `.sha512`; avoid MD5 and SHA-1) and an OpenPGP signature file next to each document |
| Discovery | Reference the provider metadata from your `security.txt` (RFC 9116) with a CSAF field, and list the provider with CSAF aggregators where appropriate |
| Validation | Validate against the CSAF 2.0 JSON schema and run the standard's mandatory tests before publishing |
| Updates | Publish a new file version under the same name with an incremented tracking version; never delete a published advisory |
| Human-readable | Render the advisory page from the same source so that the two never disagree |

### 10.2 CSAF skeleton

The excerpt shows the main structure for two of the affected and fixed Windows versions. It is
illustrative: the full advisory also needs the remaining products, the VULN-2 entry, flags and
threats, so generate the real document with a CSAF tool rather than by hand and validate it.

```json
{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "publisher": { "category": "vendor", "name": "Corvid Commerce", "namespace": "https://corvid.example" },
    "title": "Privilege escalation in Corvid POS Agent update service",
    "distribution": { "tlp": { "label": "WHITE" } },
    "tracking": {
      "id": "CORVID-SA-2026-007",
      "status": "final",
      "version": "1.0.0",
      "initial_release_date": "2026-10-24T09:00:00.000Z",
      "current_release_date": "2026-10-24T09:00:00.000Z",
      "revision_history": [ { "number": "1.0.0", "date": "2026-10-24T09:00:00.000Z", "summary": "Initial release" } ]
    },
    "notes": [ { "category": "summary", "text": "Corvid Commerce has released Corvid POS Agent 5.3.3 to fix a local privilege escalation in the update service." } ]
  },
  "product_tree": {
    "branches": [ {
      "category": "vendor", "name": "Corvid Commerce",
      "branches": [ {
        "category": "product_name", "name": "Corvid POS Agent for Windows",
        "branches": [
          { "category": "product_version_range", "name": "vers:generic/>=5.3.0|<=5.3.2", "product": { "product_id": "CSAFPID-0003", "name": "Corvid POS Agent for Windows 5.3.0 to 5.3.2" } },
          { "category": "product_version", "name": "5.3.3", "product": { "product_id": "CSAFPID-0004", "name": "Corvid POS Agent for Windows 5.3.3" } }
        ]
      } ]
    } ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-YYYY-NNNNN",
      "product_status": { "known_affected": ["CSAFPID-0003"], "first_fixed": ["CSAFPID-0004"], "fixed": ["CSAFPID-0004"], "recommended": ["CSAFPID-0004"] },
      "remediations": [ { "category": "vendor_fix", "details": "Install Corvid POS Agent 5.3.3", "product_ids": ["CSAFPID-0003"] } ],
      "scores": [ { "products": ["CSAFPID-0003"], "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" } } ]
    }
  ]
}
```
The CVE ID and the *Example* CVSS v3.1 vector (7.8, High) must be replaced with your own values;
the mandatory tests reject a vector, score and severity that do not agree. `vers:` range names in
`product_version_range` follow the CSAF 2.0 recommendation; a plain description such as
"5.3.0 to 5.3.2" is also allowed but tools cannot evaluate it.

## 11. Pre-publication checklist

<!-- Guidance: Run this checklist for every version of the advisory, not only the first. Two people sign it: the author and an independent reviewer. -->

| Check | Result | Checked by |
|---|---|---|
| For each vulnerability, every concerned product ID is in exactly one status group and none is in two contradicting groups (mandatory test 6.1.6) | [Pass / Fail] | [@name] |
| Affected ranges agree with the release history and SBOMs | [Pass / Fail] | [@name] |
| Every "known_not_affected" product has a flag or an impact threat | [Pass / Fail] | [@name] |
| Every "known_affected" product has at least one remediation | [Pass / Fail] | [@name] |
| CVSS vector, score and rating are consistent and the version is stated | [Pass / Fail] | [@name] |
| CVE record content matches the advisory (description, affected versions, references) | [Pass / Fail] | [@name] |
| No exploit code, internal hostnames or customer names | [Pass / Fail] | [@name] |
| Researcher credit approved by the researcher | [Pass / Fail] | [@name] |
| CSAF file validates (schema and mandatory tests); signature and hashes published | [Pass / Fail] | [@name] |
| Human-readable page, CSAF file, release notes and customer email say the same thing | [Pass / Fail] | [@name] |
| Embargo date and time agreed with all coordinating parties | [Pass / Fail] | [@name] |

## 12. Glossary and references

<!-- Guidance: Keep definitions short and original. Link to the standards rather than quoting them. -->

### 12.1 Glossary

| Term | Definition |
|---|---|
| CSAF | Common Security Advisory Framework: an OASIS standard for machine-readable security advisories in JSON |
| Product tree | The CSAF section that names and identifies every product the advisory refers to |
| Product ID | A document-local identifier (for example CSAFPID-0001) used to refer to a product throughout the advisory |
| VEX | Vulnerability exploitability exchange: a statement of whether a product is affected by a vulnerability |
| CVSS | Common Vulnerability Scoring System, maintained by FIRST |
| CPE, PURL | Common Platform Enumeration and Package URL: identifiers for products and packages |
| TLP | Traffic Light Protocol: labels that tell recipients how widely they may share information |
| Coordinated vulnerability disclosure | Process in which the reporter and vendor agree when and how a vulnerability is made public |

### 12.2 References

| Reference | Use |
|---|---|
| OASIS, *Common Security Advisory Framework Version 2.0*, OASIS Standard, 18 November 2022, and Errata 01, 26 January 2024 (docs.oasis-open.org/csaf/csaf/v2.0) | Section structure and field paths |
| OASIS CSAF Technical Committee, CSAF 2.1 committee specification drafts (github.com/oasis-tcs/csaf), draft only | Future `metrics` with CVSS v4.0, EPSS and SSVC |
| CISA, *Minimum Requirements for Vulnerability Exploitability eXchange (VEX)*, April 2023 | VEX statuses (6) |
| CISA, *Vulnerability Exploitability eXchange (VEX): Status Justifications*, June 2022 | Justification labels (6.2) |
| FIRST, *Common Vulnerability Scoring System v4.0* (first.org/cvss/v4-0) | Severity scoring (8), named only |
| CISA, *Stakeholder-Specific Vulnerability Categorization Guide* (cisa.gov/ssvc) and CISA Known Exploited Vulnerabilities catalogue | Prioritisation context (8.2) |
| RFC 9116, *A File Format to Aid in Security Vulnerability Disclosure* (security.txt), April 2022 | Discovery of the CSAF provider (10) |
| Regulation (EU) 2024/2847 (Cyber Resilience Act), Article 14 | Notification duties (9) |
| SBOM and VEX Policy (`security/sbom-vex-policy`) | Rules for VEX evidence and approval |
| PSIRT Vulnerability Handling (`security/psirt-vulnerability-handling`) | Process that produces this advisory |
| Vulnerability Disclosure Policy (`security/vulnerability-disclosure-policy`) | Reporter intake and safe harbour |
| Security Policy (`dev/security-policy`) | Repository SECURITY.md for open-source projects |
| Release Notes (`dev/release-notes`) | Release notes that link to this advisory |

## Standard and licence note

Structure aligned with the OASIS Common Security Advisory Framework Version 2.0 (Copyright OASIS Open
2022 to 2024; the OASIS notice permits derivative works that comment on or assist in implementing the
specification); section names, field paths and enumerated values are cited so that the template
maps to the standard, and no specification text is reproduced. Based on the CISA *Minimum
Requirements for VEX* (April 2023), a work of the United States Government. CVSS is owned by FIRST
(Forum of Incident Response and Security Teams, Inc.); it is referred to by name and version only,
and readers should use the official specification and calculator at first.org. The text of this
template is original. CSAF 2.1 was at committee draft stage at the time of writing: check the
current official versions at oasis-open.org, cisa.gov and first.org before relying on this template.
Template licence: MIT.