Product Security Vulnerability Response Policy

(Updated June 3, 2026)

Introduction

At Syncro Soft, we consider the security of our systems, services and products a top priority. We recognize that unless our products meet the highest standards for security, customers will not be able to deploy them with confidence.

This Vulnerability Response Policy describes how security researchers, customers and the public can report potential vulnerabilities and how Syncro Soft handles, remediates and discloses them.

Applicability and Scope

This policy applies to vulnerabilities affecting Syncro Soft products, services, websites, and related components within the scope of Syncro Soft’s CVE Numbering Authority (CNA) responsibilities.

Security researchers, customers, and other third parties are encouraged to report potential vulnerabilities in any Syncro Soft in-scope product or service. Vulnerabilities affecting third-party components are handled according to the process described in this policy.

Syncro Soft operates in accordance with CVE Program CNA Operational Rules. Where any provision of this policy conflicts with CNA Rules, the CNA Rules take precedence.

Reporting a New Vulnerability

Syncro Soft encourages users who become aware of a security vulnerability in Syncro Soft products to contact Syncro Soft with details of the vulnerability. Syncro Soft hopes that users encountering a new vulnerability will contact us privately as it is in the best interests of our customers that Syncro Soft has an opportunity to investigate and confirm a suspected vulnerability before it becomes public knowledge.

Syncro Soft adheres to the principles of responsible disclosure and is committed to collaborating with researchers, CERTs, product users and authorities. Everyone is encouraged to report findings. We expect finders, either an individual or an organization who has found a potential vulnerability, to adhere to the same principles. Syncro Soft requests that finders:

• undertake not to disclose the vulnerability without Syncro Soft’s consent until it has been resolved;
• not to use the vulnerability for exploitation beyond the minimum necessary to demonstrate it, and
• not to take advantage of the vulnerability discovered in ways that may have harmful consequences.

Syncro Soft has established an email address that should be used for reporting a vulnerability. Please send descriptions of any vulnerabilities found to .

We recommend that the following details of the vulnerability to be included in your report:

• Name of the Product (including its build number and the affected component, if available)
• Installation or configuration prerequisites
• A detailed description of the steps required to reproduce the vulnerability. Screenshots are helpful.
• Description of the potential impact of the vulnerability.
• Any technical information and related materials we would need to reproduce the issue.

Please keep your vulnerability reports current by sending us any new information as it becomes available.

CVE ID Assignment and Disclosure Process

1 CVE ID Assignment

As a CVE Numbering Authority (CNA) for our own products, Syncro Soft is responsible for assigning CVE IDs to vulnerabilities within our scope. The following process applies:

If the vulnerability is determined to be out of scope for Syncro Soft's CNA program (e.g., it affects a third-party component), Syncro Soft will inform the reporter and, where appropriate, refer the case to the relevant CNA or to MITRE.

Public Disclosure of CVE Records

Syncro Soft is committed to timely and transparent disclosure. CVE records will be published according to the following principles:

• CVE records will be published publicly upon the availability of a fix or mitigation, or no later than 90 days from the date the vulnerability was reported to Syncro Soft, whichever comes first.
• In cases where a fix requires coordination with a third-party vendor, the 90-day target may be extended by mutual agreement between Syncro Soft and the reporter.
• CVE records are published on the CVE List (https://cve.mitre.org) and referenced in the corresponding Syncro Soft Security Advisory posted at https://www.oxygenxml.com/security/advisories/.
• Syncro Soft will notify the reporter prior to publication of the CVE record, providing a reasonable opportunity (typically 5 business days) to review the draft CVE details for accuracy.
• If a vulnerability is actively being exploited in the wild, Syncro Soft reserves the right to publish the CVE record earlier, even before a full fix is available, in order to protect customers.

Reporter's Role in the Disclosure Process

Syncro Soft values the contribution of security researchers and external reporters. As a reporter, you can expect the following:

• You will be kept informed of the progress of your report, including confirmation, CVE ID assignment, planned fix timeline, and publication date, if that's the case.
• You may request to be credited in the Security Advisory and/or CVE record. Syncro Soft will honor such requests unless there is a legal or security reason not to do so. Credit will be given in the form preferred by the reporter (name, handle, organization, or anonymous).
• You will be notified before public disclosure to allow for coordinated release. If you intend to publish your own research or advisory, we ask that you coordinate the timing with Syncro Soft to avoid exposing customers before a fix is available.
• You are expected to maintain confidentiality of the vulnerability details until the CVE record is publicly published or until Syncro Soft provides explicit written consent for earlier disclosure.
• If you do not agree with the CVE details (description, severity, affected versions), you may raise your concerns with Syncro Soft before publication. Syncro Soft will make reasonable efforts to address legitimate concerns.

In the event that Syncro Soft and the reporter cannot reach agreement on disclosure timing, Syncro Soft will default to publishing within 90 days of the original report date, in alignment with responsible disclosure norms.

Security Vulnerability Sources Monitored

Syncro Soft receives private reports on vulnerabilities via e-mail from customers or other third party findings, internal development, or research efforts.

Syncro Soft also monitors public repositories of software security vulnerabilities to identify newly discovered vulnerabilities that may affect one or more of our products.

Assessment

All security vulnerabilities reported to Syncro Soft are thoroughly investigated, assessed and prioritized. The assessment process differs depending on whether the vulnerability originates in Syncro Soft’s proprietary code or in a third-party component integrated into our products, as described below:

• Vulnerabilities in Syncro Soft Products (In-Scope)

  For vulnerabilities originating within our own codebase, Syncro Soft uses the Common Vulnerability Scoring System (currently CVSS v4.0) to evaluate severity. Syncro Soft will calculate the CVSS Base Score and assign a CVE ID, as we act as the CVE Numbering Authority (CNA) for our own products.

• Vulnerabilities in Third-Party Components (Out-of-Scope for CVE Assignment)

  Syncro Soft products rely on various third-party open-source and commercial libraries. When a reported vulnerability affects a third-party library or component used in Syncro Soft products (e.g., OpenSSL, Apache Log4j, Spring Framework, etc.), Syncro Soft follows the following triage process:

  • A CVE already exists for the third-party component.

    Syncro Soft will conduct an internal impact analysis to determine whether the vulnerability is exploitable in the context of its products. For tracking and context, Syncro Soft will reference the most recent CVSS base score available from an authoritative source (NIST NVD or the component vendor), regardless of the CVSS version used by that source.

    • If the analysis concludes that Syncro Soft products are not affected — for example, because the vulnerable functionality is not reachable in the way Syncro Soft products use the library — Syncro Soft may not issue a fix. However, for vulnerabilities with a Critical or High severity score, Syncro Soft may choose to publish a Security Advisory explicitly stating that its products are not affected, in order to provide clarity to customers.
    • If the analysis concludes that Syncro Soft products are affected, Syncro Soft will adopt the existing CVSS score or recalculate it based on how the vulnerability affects our products specifically. Syncro Soft will issue a Security Advisory referencing the existing CVE and will deliver a fix or workaround in accordance with the remediation timelines.
  • No CVE exists yet for the third-party component

    Where such a CVSS base score is not available from NIST or a vendor, Syncro Soft will calculate an internal baseline score to prioritize the issue and will notify the third-party vendor of the vulnerability. The responsibility for assigning and publishing a CVE ID lies with the third-party vendor's CNA, or with MITRE. Syncro Soft will coordinate on the timeline and will publish its own Security Advisory once a fix or mitigation is available. Syncro Soft will not assign a CVE ID for vulnerabilities in code that is not within its CNA scope.

  • Integration/Wrapper Flaws

    If the vulnerability stems not from the third-party library itself, but from how Syncro Soft integrates, configures, or wraps that component, it is considered an in-scope vulnerability. Syncro Soft will act as the CNA, assign a CVE ID, and calculate a CVSS v4.0 score for this specific implementation flaw.

Severity classifications

Regardless of the scenario above, the overall severity used in Syncro Soft communications will be determined by the highest applicable CVSS base score and assigned one of the following classifications:

More information on CVSS and how the score is calculated can be obtained from https://www.first.org/cvss/ (including examples: https://www.first.org/cvss/examples).

Vulnerability Notifications

Syncro Soft will use reasonable efforts to make an initial assessment within these targets after notification.

When a fix or corrective action for a vulnerability becomes available, Syncro Soft will notify its customers by the means of Security Advisory which details the security vulnerability and provides a reference to the release notes which details the fix or corrective action. Based on the nature of the vulnerability and its classification, the Advisory may include a recommended mitigation action, a recommendation regarding the use of a 3rd party provided patch, a planned Syncro Soft software fix or update, and/or additional guidance regarding the vulnerability.

As each security vulnerability case is different, Syncro Soft may take alternative actions to notify customers or a limited/specific group of customers, if necessary. For example, a security notification may also be transmitted through the "Check for updates" functionality available in desktop products like Editor, Developer, Author, and/or in the release notes.

CVE Record Publication. When a vulnerability is publicly disclosed, Syncro Soft will publish the corresponding CVE Record to the CVE List through the official CVE Program channels (CVE Services API) within a reasonable timeframe following disclosure, or no later than 72 hours. The CVE ID will be referenced in the Security Advisory published at www.oxygenxml.com/security/advisories and communicated to subscribers of our Security Announce mailing list.

Remediation

Important Note on CVE-Eligible Remediation: While Syncro Soft aims to align medium and low severity fixes with scheduled product release cycles (Major/Minor/Updates) as outlined in the table above, any vulnerability within our CNA scope that qualifies for a CVE assignment are generally subject to the 90-day public disclosure window described in the "Public Disclosure of CVE Records" section. In the event that a scheduled release falls outside this 90-day window, Syncro Soft will expedite the remediation by issuing an out-of-cycle maintenance patch or workaround prior to the disclosure date to ensure customer protection.

Syncro Soft is committed to patching vulnerabilities within 90 days or less, and disclosing the details of those vulnerabilities when fixes are published. A fix may take one or more of these forms:

• A new major or minor release of the affected Syncro Soft product
• A new maintenance or update release of the affected Syncro Soft product
• A patch that can be installed on top of the affected Syncro Soft product
• Instructions to download and install an update or patch for a third-party software component that is part of the Syncro Soft product installation
• A corrective procedure or workaround that instructs users in adjusting the Syncro Soft product configuration to mitigate the vulnerability.