Authors: Elijah Swift & Gregg Arquero
Introduction
The enterprise threat landscape is evolving rapidly as advanced AI models like Claude Mythos accelerates vulnerability discovery and analysis. This reduces the time between disclosure and potential exploitation, placing pressure on organizations to respond faster than ever before. Manual processes for tracking and evaluating advisories are no longer sufficient. Organizations must be able to automatically ingest vulnerability data, correlate it with their environments, and continuously assess risk. Without this capability, critical exposures can be missed, increasing operational risk.
What is the Common Security Advisory Framework (CSAF)
To address this challenge, organizations are turning to standardized, machine-readable security data formats. The Common Security Advisory Framework (CSAF) is an open standard developed by OASIS to provide a machine-readable format for sharing security advisories. CSAF enables organizations to consistently communicate vulnerability information, including affected products, severity, and remediation guidance, in a structured JSON format. Its primary goal is to move the industry away from manual, document-based advisories toward automated, scalable processing of security data. By standardizing how vulnerability intelligence is produced and consumed, CSAF allows organizations to integrate advisory data directly into their tools and workflows, significantly improving the speed and accuracy of vulnerability assessment and response.
This shift is already being adopted across the industry, including within IBM’s mainframe ecosystem. Aligning with this industry standard, support for CSAF was introduced in the IBM Z and LinuxONE Security Portal at the end of 2025 as a new Primary Resource. This enhancement provides downloadable, structured security data for z/OS in CSAF 2.0 JSON format, including APAR-level details enriched with CVE, CWE, and CVSS information when available. By making this data available in a consistent, machine-readable form, IBM enables clients to automate ingestion, correlate vulnerabilities with their environments, and drive more advanced risk analysis across their mainframe workloads.
Why turn to CSAF?
One of the broadest advantages to embracing an open standard is the ecosystem that comes with it. OASIS’s commitment to CSAF provides a centralized location where many different parties can look for updates to the standard as well as new shared tools and utilities to work with it. Adoption of this open standard allows for a streamlined way of sharing information that is easier to navigate for both vendors looking to make new data available, and clients looking to better understand their environments. Since CSAF extends beyond the Z platform it allows the platform to tap into a larger network and community of open tools.
This benefit also manifests in the form of standardization and interoperability. CSAF’s JSON roots allow all sorts of automation and scripting tools to easily parse and work with the data. Languages like Java, Python and Go may be the most popular, but even C++ has stable 3rd party libraries that support JSON operations. This is part of what enables the broad community support and handful of readily available tools that CSAF has, but it is also a strength for individual adoption as well. With these options available, organizations can relatively easily adapt CSAF into existing data pipelines. Adopting automation like this in your shop can offer significant improvements over manually reviewing data on individual APARs or patches as this can save significant time and cut down on human error. In the current threat landscape, lag-time and errors can both leave your organization significantly more vulnerable.
How to use CSAF to automate vulnerability analysis
As we discussed in the previous section, the nature of JSON leaves it open to automation with lots of frameworks and tools. The following example code is written in python, displaying data that does not represent real vulnerability information, but contains the same type and format of data expected by the CSAF framework.
import json #library to use JSON in python
import pprint #library to print dictionary structures in human-readable forms
#First we must load the CSAF JSON into a dictionary structure in python
csaf_json_file_name = "csaf.json"
with open(csaf_json_file_name, "r") as file:
data = json.load(file)
#Once we have a dictionary structure, we can access fields in the JSON with the appropriate key
document = data["document"]
severity = document.get("aggregate_severity").get("text","")
products = document.get("product_tree", {}).get("full_product_names", [])
product_names = [product.get("name","") for product in products]
#This puts the product names (list at the moment) as a more legible string
product_names_list_as_string = pprint.pformat(product_names)
print(f"The csaf file {csaf_json_file_name} represents a '{severity}' severity problem")
print(f"This applies to all the following products:\n{product_names_list_as_string}")
This portion of the script produced the following output:
The csaf file csaf.json represents a 'Low' severity problem
This applies to all the following products:
['Sample Product for z/OS version FMI0100',
'Sample Product for z/OS version FMI0200']
Reviewing this CSAF record, we can see that this represents a Low severity problem and that all users of 'Sample Product' with versions FMI0100 or FMI0200 are affected. Now, we know we have FMI0200 installed, so we probably want to apply this patch, but we might want to know more about our exposure before building out the timeline for this issue, so let’s look for that.
#continuing where we left off before, now we can look at the vulnerabilities
vulnerabilities = document.get("vulnerabilities")
vulnerabilities_dict_as_string = pprint.pformat(vulnerabilities)
print(f"This patch addresses the following vulnerabilities: \n{vulnerabilities_dict_as_string}")
This portion of the script produced the following output:
[{'cve': 'CVE-1900-12345',
'cwe': {'properties': {'id': 'CWE-000',
'name': 'Not a real CVWE'}},
'product_status': {'fixed': ['UJ00001']},
'references': [{'category': 'external',
'summary': 'CVE Information Source',
'url': 'https://cveawg.mitre.org/api/cve/CVE-1900-12345'}],
'scores': {'cvss_v3':
{'attackComplexity': 'HIGH',
'attackVector': 'NETWORK',
'availabilityImpact': 'NONE',
'baseScore': 3.1,
'baseSeverity': 'LOW',
'confidentialityImpact': 'NONE',
'integrityImpact': 'LOW',
'privilegesRequired': 'LOW',
'scope': 'UNCHANGED',
'userInteraction': 'NONE',
'vectorString': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N',
'version': '3.1'}
}
},
{'cve': 'CVE-1950-54321',
'cwe': {'properties': {'id': 'CWE-0', 'name': 'Not a real CWE either'}},
'product_status': {'fixed': ['UO00001', 'UO00002']},
'references': [{'category': 'external',
'summary': 'CVE Information Source',
'url': 'https://cveawg.mitre.org/api/cve/CVE-1950-54321'}],
'scores': {'cvss_v3':
{'attackComplexity': 'HIGH',
'attackVector': 'NETWORK',
'availabilityImpact': 'NONE',
'baseScore': 3.1,
'baseSeverity': 'LOW',
'confidentialityImpact': 'NONE',
'integrityImpact': 'LOW',
'privilegesRequired': 'LOW',
'scope': 'UNCHANGED',
'userInteraction': 'NONE',
'vectorString': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N',
'version': '3.1'}
}
}]
Now we know that the patch identified by this vulnerability fixes CVE-1900-12345 and CVE-1950-54321 and that these CVE’s relate to these specific weaknesses here. With that in mind, I can put the information together to plan my patch appropriately, and install the patch described in this document.
This may be a rudimentary example, but it also only demonstrates the tip of the iceberg. Since all of this can be done cleanly in a variety of different automation-friendly languages, processing this data can cleanly integrate into your organization’s existing pipelines. This allows for a more automated and robust mechanism for assessing and applying security patches in your environment. Minimizing the time and errors spent in these operations is critical in the new vulnerability landscape emerging with AI-identified problems.
More information
For more information or updates on IBM Z’s implementation of CSAF, please see the FAQ for the IBM Z and Linux One Security Portal.
References: