{
  "$schema": "https://www.fedramp.gov/schemas/fedramp-accepted-vulnerability-info-schema-2026-06-24.json",
  "certificationPackageOverviewUri": "https://example.invalid/fedramp/certification-package-overview.json",
  "reportPeriod": {
    "from": "2026-07-01T00:00:00Z",
    "to": "2026-07-31T23:59:59Z"
  },
  "acceptedVulnerabilities": [
    {
      "vulnerabilityDetail": {
        "providerTrackingId": "FRV-DEMO-005",
        "detection": {
          "detectedAt": "2025-12-15T10:00:00Z",
          "detectionSource": "Software composition analysis"
        },
        "vulnerabilityDescription": "Unsupported reporting library with no vendor fix. Fictional training record.",
        "potentialAgencyImpact": "The affected component is isolated from direct customer traffic and cannot access federal customer data.",
        "evaluationCompletedAt": "2025-12-17T15:00:00Z",
        "isInternetReachable": false,
        "isLikelyExploitable": false,
        "currentRating": 1,
        "overdueStatus": {
          "isOverdue": false
        },
        "supplementaryRiskInformation": "Execution is blocked by policy and segmentation; replacement is scheduled in the next major release.",
        "finalDisposition": "Fully Mitigated"
      },
      "acceptanceRationale": "The vulnerability remains present after 192 days because no supported vendor fix exists. Validated controls fully mitigate the current risk while the component is replaced."
    }
  ]
}