State the permanent fix as the solution, with the exact fixed version or patch, and any interim mitigation as a workaround, with the exact setting or step. Keep them separate. The CVE Record Format gives each its own optional field, so readers and tools can tell a real fix from a stopgap.
Definitions
A solution is the remediation: upgrade to a named version, apply a named patch, change a named configuration permanently. A workaround is a mitigation for people who cannot yet apply the solution: disable a feature, block a path, restrict access. The schema stores both as lists of descriptions, each with a minimum of one item when present, so you can give several.
A third optional field, configurations, describes the conditions needed to exploit the flaw. It tells readers when they are not exposed.
A template
| Section | What to write |
|---|---|
| Solution | Upgrade to version X, or apply patch Y, with a link to release notes |
| Workaround | Exact setting, file, flag or rule, plus the cost of using it |
| Configurations | The setting or exposure that makes the flaw reachable |
| How to verify | A command or check that shows the fix or workaround is in place |
Writing a workaround people can use
- Name the exact setting. Not "restrict access", but the parameter and value.
- Say what breaks. Every workaround costs something, and customers deserve to know before they apply it.
- Say how to undo it after upgrading.
- Say whether it fully blocks the issue or only reduces it. Be honest if it is partial.
Writing a solution people can trust
- Name the fixed version for every supported branch, not only the newest. See fixed versions and backports.
- Link release notes that match the advisory wording.
- Mention required follow up steps such as rotating keys or restarting services.
- Do not call something fixed that is only mitigated.
Common mistakes
| Mistake | Better |
|---|---|
| Only a workaround, no fix date | Give a date or say none is planned |
| Vague "apply updates" | Name the version |
| Workaround buried in a long paragraph | Its own labelled section |
| Different text in advisory and record | Generate both from one source |
Use the full layout in what to include in a security advisory and the contents checklist for vendors.
Try it yourself
Click through it at your own pace, or open it full screen.
Notice how a clear fixed version turns into an exact upgrade action.
Quick check
What is the difference between a workaround and a solution?
A solution is the permanent remediation. A workaround is an interim mitigation for people who cannot yet apply it.
Should I describe what a workaround breaks?
Yes. Customers need to weigh the cost before applying it.
Safeguard's autonomous remediation can open fix PRs for a vulnerable dependency, off by default with every category on Manual. Try a free scan.
Sources
Last reviewed: 19 October 2026.
