Agent WranglersCMP-49Required EU law
Report exploited vulnerabilities in your products
Since 11 September 2026, report every actively exploited vulnerability and severe incident in a CRA product. Use the ENISA single reporting platform.
Region
European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.
How to do it
CRA Article 14 asks for an early warning within 24 hours and a notification within 72 hours. A final report follows 14 days after a fix is available for a vulnerability, or one month after the notice for an incident. The duty also covers products placed on the market before December 2027. Tell users about the problem and what to do. Set up your accounts on the reporting platform before you need them. Compute the deadlines with the reporting clocks. Tell researchers where to report in a security.txt file.
How to check
The obligations register names at least two people with active accounts on the reporting platform. A test of the incident tool with the cra flag shows the 24-hour and 72-hour deadlines.
Sources
Related rules
- CMP-21 Start every reporting clock from one moment in Compliance and governance
- CMP-48 Decide whether the Cyber Resilience Act covers your product in Compliance and governance
- WEB-143 Tell people how to report a hole in Website
- CMP-73 Publish an advisory for every fixed vulnerability in Compliance and governance
- IOT-37 Make every report and advisory name the model and firmware version in Connected devices
- OSS-29 Report actively exploited holes as a steward in Open source maintenance
- TDD-13 Record the product's Cyber Resilience Act duties in Technical due diligence
- APS-81 Fix each finding within the time its severity allows in Application security
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/compliance/security-laws/cra-vulnerability-reporting">Agent Wranglers compliance and governance playbook</a>. In code you write, add a comment next to it with the same link.