Cloud Software Group Security Release and Disclosure Policy

Purpose

Software vulnerability discovery has accelerated significantly due to advanced automated analysis pipelines and AI-driven security research techniques. To provide predictability, transparency, and operational efficiency for our customers, Cloud Software Group (“Company”) has adopted a common security release framework for its business units (“BUs”).

This policy outlines the cadence, criteria for Out-of-Band releases, notification structure, and CVE assignment rules governing security updates across all Cloud Software Group BUs.

Scope

This policy applies to all Cloud Software Group BUs and the Products they develop, produce, or manage. All BUs follow the common baseline cadence below. Individual BUs may choose to adopt stricter practices.

Definitions

Actively Exploited Vulnerability: A Vulnerability for which the Company has credible evidence of exploitation in the wild before a fix or mitigation is available to customers.

Out-of-Band Release: A security update released outside the scheduled monthly cadence.

Patch Tuesday: The second Tuesday of each month, used as a reference date for customer patch cycles.

PSIRT: Product Security Incident Response Team.

Product: Commercially available software developed or managed by a BU of Cloud Software Group.

Vulnerability: A weakness in a Product that could be exploited to compromise its security. Vulnerabilities can be present in Company-owned code or in upstream code contained in Company Products.

Policy

Cloud Software Group delivers standard security updates in scheduled releases on a monthly cadence and publishes its release dates in advance. Whenever possible, dates will align to Patch Tuesday to support customers’ own patch management cycles. The dates are targets and may change.

Out-of-Band Releases

PSIRT may invoke an Out-of-Band Release for a Product, in consultation with the BU responsible for the Product. Severity alone does not automatically trigger such a release. Any of the following factors may prompt an Out-of-Band Release:

• Vulnerability is an Actively Exploited Vulnerability
• Vulnerability, or a working exploit for it, has been publicly disclosed before a fix is available
• Vulnerability is listed in the CISA Known Exploited Vulnerabilities (“KEV”) Catalog

Where a fix or mitigation is validated for an Out-of-Band Release, the BU will publish its advisory and the fix or mitigation as soon as practicable. A Vulnerability already planned for a scheduled release may be moved to an Out-of-Band Release promptly once a trigger is met.

Pre-Notification

BUs may provide pre-release information on certain Product Vulnerabilities via a BU-run Pre-Notification Program. Membership is BU-specific, voluntary, at the BU’s discretion, and subject to adherence to a program-specific NDA. Pre-notification is not guaranteed and may be withheld or shortened where delay would increase risk to customers.

CVE Grouping and Scoring Policy

Cloud Software Group and BUs acting as CVE Numbering Authorities (CNAs) apply the following class-based CVE assignment rules to simplify Vulnerability tracking and reduce advisory overhead:

• Class-level assignment. When a release fixes several instances of one weakness class in one Product, in the same affected versions, one CVE is assigned for that class and mapped to the corresponding CWE, rather than one CVE per code path.

• Product boundary. A CVE is scoped to one Product. It is assigned across Products only where the affected code is identical and shipped from a single source.

• Individual CVE assignment. A finding receives its own CVE when it differs materially from the rest of its class in CVSS severity (a different qualitative rating), attack vector, authentication requirement, or exploitation status, or is independently fixable. Grouping never lowers the visibility of the most severe finding.

• Every published CVE includes:

  • An associated CWE identifier
  • A CVSS v4.0 score and vector reflecting the highest severity finding within the grouped class
  • Explicit lists of affected and fixed versions
  • A statement of exploitation status known to the Company as of the publication date

Supported Versions and Customer Responsibilities

Security updates are provided for supported versions only, as defined by each BU’s lifecycle policy. Customers are responsible for applying updates and mitigations in accordance with the applicable advisory.

Disclosure

Cloud Software Group follows ISO/IEC 29147 for vulnerability disclosure. Security advisories are published at each BU’s security advisory page and disclosed to all customers and the public. Each advisory states affected and fixed versions, CVSS score, CWE and known exploitation status. Advisories are updated if this information changes, including if a Vulnerability is later found to be exploited. Customers can receive advisories by email through their support notification alerts.

Vulnerabilities may be reported to PSIRT at secure@cloud.com (PGP key available) or through the Cloud Software Group Bug Bounty Program on HackerOne. Reporters are credited in the Hall of Fame unless they decline.

Exceptions

Exceptions to this policy require written approval from the CISO.

Nature of This Policy

This Security Release and Disclosure Policy describes the Company’s current practices. It is not a warranty, service-level commitment, or contractual term, and it does not modify any customer agreement or support entitlement. The Company may change this policy or deviate from it where security, legal, or operational considerations require. BU advisories govern Product-specific details.