Once a security update exists, a vendor should publicly share a description of the vulnerability, information that lets users identify the affected product, its impact and severity, and clear steps to remediate. That list comes from Annex I, Part II of the EU Cyber Resilience Act, and it is a sound template even outside the EU.
Where the list comes from
Regulation (EU) 2024/2847, the Cyber Resilience Act (CRA), sets vulnerability handling requirements in Annex I, Part II. Item 4 says that once a security update has been made available, manufacturers must share and publicly disclose information about fixed vulnerabilities. In duly justified cases, a manufacturer may delay publication until users have had the chance to apply the patch, if it judges the risk of publishing to outweigh the benefit.
Most of the regulation applies from 11 December 2027, so this is a preview of what is coming, not a deadline that has already passed. Check the regulation text and your own legal advice before relying on any summary, including this one.
The five things to publish
| Element | What a reader needs | Where it often goes wrong |
|---|---|---|
| Description | What the flaw is, in plain words | Copying a CVE title with no context |
| Affected products | Product names and version ranges | Listing a library, not the product users run |
| Impact | What an attacker could do | Vague words like "may be at risk" |
| Severity | A score plus the vector it came from | A score with no source |
| Remediation | The fixed version and how to get it | A fix with no upgrade path |
Step by step
- Confirm the fixed release is available to users, not only built.
- Write the affected product list from your release records, using product names and versions customers recognise.
- State impact in one or two sentences an administrator can act on.
- Add severity, and say which scoring system and version you used.
- Give the remediation: fixed version, upgrade steps, and any workaround for those who cannot upgrade yet.
- Publish a human readable page and, if you can, a machine readable record alongside it.
- Link the advisory from your security contact page so people can find it.
Human readable and machine readable
A web page serves a person reading an alert. A machine readable record, such as a CSAF advisory or a VEX document, lets a customer's tooling match your statement to their inventory. The two should say the same thing. If they disagree, customers will trust neither.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a finding changes once a fixed version is known.
Quick check
Can a vendor delay publishing details after a fix?
Annex I, Part II allows it only in duly justified cases, where the security risks of publication outweigh the benefits, and only until users have had the chance to apply the patch.
Does this apply to products sold outside the EU?
The regulation covers products made available on the EU market. The publishing checklist is still a reasonable baseline for any vendor, but confirm scope with counsel.
Safeguard's SBOM and dependency scanning and compliance evidence automation can help a vendor keep the release records an advisory depends on. You can try a free scan of a project to see what an inventory looks like.
Sources
- Regulation (EU) 2024/2847, EUR-Lex, Annex I Part II and Article 71
Last reviewed: 19 October 2026.
