Report exploited vulnerabilities in your products

How to do it

CRA Article 14 asks for an early warning within 24 hours and a notification within 72 hours. A final report follows 14 days after a fix is available for a vulnerability, or one month after the notice for an incident. The duty also covers products placed on the market before December 2027. Tell users about the problem and what to do. Set up your accounts on the reporting platform before you need them. Compute the deadlines with the reporting clocks.

How to check

The obligations register names at least two people with active accounts on the reporting platform. A test of the incident tool with the cra flag shows the 24-hour and 72-hour deadlines.