At a glance
- A vulnerability is actively exploited if there is reliable evidence that a malicious actor has exploited it in a system without permission of the system owner (Art. 3(42)).
- Findings from testing, test laboratories or bug bounty programmes without evidence of exploitation are not subject to mandatory reporting.
- The deadline starts with awareness, that is after an initial assessment carried out without undue delay, with a reasonable degree of certainty.
- If the vulnerability is in a supplier component, the manufacturer of the end product reports if it is exploitable and exploited there.
- Public catalogues such as CISA KEV and ENISA’s EUVD are important indicators that have to be matched against your own SBOMs.
The legal definition
Art. 3(42) CRA defines an actively exploited vulnerability as “a vulnerability for which there is reliable evidence that a malicious actor has exploited it in a system without permission of the system owner”.
The CRA also has two related terms: a vulnerability is a weakness, susceptibility or flaw that can be exploited by a cyber threat (point 40). An exploitable vulnerability can be effectively used by an unauthorised third party under practical operational conditions (point 41). Only the third level is subject to reporting under Art. 14: actual, evidenced exploitation.
What does not have to be reported
Recital 68 makes clear that vulnerabilities discovered without malicious intent during testing, investigation or good-faith disclosure should not be subject to mandatory reporting. The Commission adds in its FAQs: a vulnerability found through a bug bounty programme or a test laboratory does not have to be reported without evidence of prior exploitation.
A zero-day, on the other hand, has to be reported as soon as there is reliable evidence of malicious exploitation, even if no fix exists yet.
When the deadline starts
All deadlines run from the moment the manufacturer becomes aware. The CRA does not define this. The Commission follows the rules from NIS2 and personal data breach notification under the GDPR: awareness exists when the manufacturer, after an initial assessment carried out without undue delay of a suspicious event, establishes with a reasonable degree of certainty that a vulnerability is being actively exploited.
The CRA does not prescribe which channels a manufacturer has to monitor. The Commission names as typical routes notices from customers and partners, threat intelligence reports, notices from authorities, ethical hackers, own telemetry, honeypots and dark web monitoring.
Vulnerabilities in supplier components
Machines and devices usually contain third-party building blocks: operating systems, libraries, fieldbus stacks, web servers in operator panels. According to the Commission’s FAQs and guidance, the following applies to such components:
- If the actively exploited vulnerability is in an integrated component, the manufacturer of the end product reports. The manufacturer of the component also reports if it placed the component on the market itself.
- If the vulnerability is not exploitable in your own product, for example because the affected code cannot be reached, or if it is not exploited there, that manufacturer has no reporting obligation.
- Independently of this, the manufacturer reports a vulnerability it has found to the party maintaining the component (Art. 13(6)).
This makes the question “Is this component in my product, in which version, and can the vulnerability be reached there?” the core question. It can only be answered with an up-to-date software bill of materials for each firmware version.
Stop counting deadlines by hand
Fixradar matches your SBOMs every day, detects actively exploited vulnerabilities and prepares the early warning, notification and final report for the ENISA platform.
How manufacturers detect exploitation
Public catalogues make actively exploited vulnerabilities visible. They do not replace your own assessment, but they provide the most important indication:
| Source | What it provides |
|---|---|
| CISA KEV | Catalogue of the US agency CISA listing vulnerabilities with evidence of exploitation |
| ENISA EUVD | ENISA’s European Vulnerability Database, with exploited vulnerabilities flagged |
| NVD and OSV | Descriptions, severity ratings and affected versions for CVE identifiers and open source packages |
| Supplier security advisories | Advisories on components, often in CSAF format |
| Your own notices | Reports from customers, service technicians, remote maintenance and your own telemetry |
A match in a catalogue means the vulnerability is being exploited somewhere. Whether this triggers a reporting obligation for your own product depends on whether the affected component is included in the affected version and is exploitable there. This check should be fast and documented in a traceable way.
Examples from mechanical engineering
- Web server in the operator panel: A vulnerability in the built-in web server library is listed in the KEV catalogue. The panel uses exactly this version with web access enabled. Reportable as soon as the initial assessment confirms this.
- Library without reachable code: An exploited vulnerability affects a function that is not included in the firmware. No reporting obligation for this product; the reasoning belongs in the documentation, for example as a VEX statement.
- Finding in a penetration test: A commissioned laboratory finds a new vulnerability. Without evidence of exploitation there is no reporting obligation; the vulnerability is fixed and reported to the affected suppliers.
- Notice from a customer: An operator reports unusual access via the remote maintenance connection, and the analysis shows exploitation of a known vulnerability. Reportable; the 24 hours run from the result of the initial assessment.
Frequently asked questions
Does every vulnerability with a high CVSS score have to be reported?
No. Severity is not the deciding factor. A vulnerability has to be reported if there is reliable evidence of malicious exploitation.
Do I have to report if a vulnerability in a component is on the KEV list?
Yes, if the component is in the product in the affected version and the vulnerability is exploitable and exploited there. If it is not exploitable in your own product, no. The result of the check should be documented.
When do the 24 hours start?
From awareness, that is when an initial assessment carried out without undue delay shows active exploitation with a reasonable degree of certainty.
Do I have to report vulnerabilities from my bug bounty programme?
Not without evidence of prior malicious exploitation. A voluntary report under Art. 15 is possible.
Sources
- Regulation (EU) 2024/2847 (Cyber Resilience Act), EUR-Lex
- European Commission: FAQs on the Cyber Resilience Act, version 1.4 (4 September 2026)
- European Commission: Guidance on the application of Regulation (EU) 2024/2847, C(2026) 5252 (27 July 2026)
- ENISA: CRA Single Reporting Platform, Frequently Asked Questions (15 October 2026)
As of: November 2026. This page reflects the general legal position and is not legal advice for individual cases.