EU CRA Vulnerability Reporting: 24-Hour and 72-Hour Rules

If an actively exploited vulnerability is found in your product, can you submit an early warning within 24 hours?

The reporting obligations under Article 14 of the EU Cyber Resilience Act (CRA) have applied since 11 September 2026. Even products placed on the EU market before 11 December 2027 are covered, as long as the reporting conditions are met.

📌 Four key points on CRA vulnerability reporting

🔹 What has to be reported? Actively exploited vulnerabilities in the product, and severe incidents having an impact on the security of the product. Not every CVE you discover has to be reported.
🔹 24-hour and 72-hour notifications:
・Within 24 hours: submit an early warning, indicating the Member States in which the product has been made available (where applicable). An early warning of an incident must at least indicate whether the incident is suspected of being caused by unlawful or malicious acts.
・Within 72 hours: submit a vulnerability or incident notification with the general information available (for a vulnerability, the nature of the vulnerability and of the exploit; for an incident, the nature of the incident and an initial assessment), the corrective or mitigating measures taken and those users can take, and, where necessary, how sensitive the information is.
Both deadlines run from the moment the manufacturer becomes aware of a vulnerability or incident that meets the reporting conditions, and the notification must be made without undue delay.
🔹 Final report deadlines:
・Actively exploited vulnerability: within 14 days after a corrective or mitigating measure is available.
・Severe incident: within one month after the 72-hour incident notification is submitted.
🔹 Reporting and informing users: Notify the CSIRT designated as coordinator and ENISA simultaneously via the ENISA Single Reporting Platform (SRP). The CSIRT designated as coordinator is, as a general rule, the CSIRT of the Member State where the manufacturer has its main establishment in the EU. For manufacturers with no establishment in the EU, it is determined in order by the Member State of the authorised representative, the importer, the distributor and so on. Manufacturers must also inform impacted users (and, where appropriate, all users) and, where necessary, describe the mitigating and corrective measures users can take.

🔍 Is your company facing this kind of challenge?

Suppose an open-source component used in an industrial PC (IPC)'s firmware is actively exploited by attackers. The cybersecurity and R&D teams need to establish quickly:
✅ Which firmware versions use the component?
✅ Which product models are affected?
✅ Which customers have these products been shipped to?
✅ Which functional or security tests need to be re-verified?
If component, firmware version, product model and customer data are spread across different systems, it may be hard to complete the impact analysis quickly, even once the vulnerability has been found. Networking equipment and energy storage systems (ESS) face the same challenge.

💡 How can companies prepare in advance?

1️⃣ Build product traceability links: Map "software component → firmware version → product model → customer shipped to".
2️⃣ Set up a vulnerability assessment mechanism: Clearly record when you became aware, the evidence of exploitation, the affected products and the basis for your decisions.
3️⃣ Prepare for reporting in advance: Designate a reporting contact (an Assigned Representative on the SRP) and have them create a personal EU Login account with MFA in advance; get familiar with the SRP reporting process and confirm which CSIRT designated as coordinator applies. ENISA advises registering on the SRP and starting manufacturer validation only when you actually need to submit a notification; with an active EU Login account, registration takes just a few minutes.
⚠️ Not every CVE has to be reported! When the reporting conditions are met, submit the early warning within 24 hours first; you don't need to wait for the full analysis to be completed.

For manufacturers, CRA reporting is not just the cybersecurity team’s job. It also involves bringing together information from R&D, product management, quality and customer service. SBOMs, product version management and requirements traceability can help companies analyse the scope of a vulnerability’s impact more efficiently, supporting reporting and the subsequent remediation work.

👉 Want to assess your company’s vulnerability impact analysis and product traceability capabilities?

Get in touch with Anselm (安盛資訊).

📩 Contact Anselm: sales@anselm.com.tw

Further reading: EU CRA series | Previous article: EU CRA SBOM: Which Software and Firmware Do Industrial PCs Need to Track? | Next article: EU CRA Vulnerability Handling and Support Period: Ongoing Post-Market Responsibilities

This article is for general information only and does not constitute legal advice. Official sources: Regulation (EU) 2024/2847 (Articles 14, 69 and 71); ENISA Single Reporting Platform; ENISA SRP FAQ (questions 9 and 28).