--- title: "Report exploited vulnerabilities in your ยท Agent Wranglers" url: https://agentwranglers.se/playbook/compliance/security-laws/cra-vulnerability-reporting id: CMP-49 level: Required applies: digital-product region: EU risk: law updated: 2026-10-27 build: a2a6bdfed830 tokens: 1036 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Report exploited vulnerabilities in your products For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Security laws](https://agentwranglers.se/playbook/compliance/security-laws.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. - ID: CMP-49 - Level: Required - Chapter: [Security laws](https://agentwranglers.se/playbook/compliance/security-laws.md) - Rule: Since 11 September 2026, report every actively exploited vulnerability and severe incident in a CRA product. Use the ENISA single reporting platform. - Check: The obligations register names at least two people with active accounts on the reporting platform. A test of the incident tool with the `cra` flag shows the 24-hour and 72-hour deadlines. - Risk: A law broken - Applies when: The project sells or hands out software or devices that others run, not only a hosted service. - Region: European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds. - How: CRA Article 14 asks for an early warning within 24 hours and a notification within 72 hours. A final report follows 14 days after a fix is available for a vulnerability, or one month after the notice for an incident. The duty also covers products placed on the market before December 2027. Tell users about the problem and what to do. Set up your accounts on the reporting platform before you need them. Compute the deadlines with the [reporting clocks](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/reporting-clocks.md). Tell researchers where to report in a [security.txt file](https://agentwranglers.se/playbook/website/standard-addresses/security-txt.md). ## Sources - [Cyber Resilience Act Article 14 on reporting](https://eur-lex.europa.eu/eli/reg/2024/2847/oj) ## Related rules - CMP-21 [Start every reporting clock from one moment](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/reporting-clocks.md) in Compliance and governance - CMP-48 [Decide whether the Cyber Resilience Act covers your product](https://agentwranglers.se/playbook/compliance/security-laws/cra-scope.md) in Compliance and governance - WEB-143 [Tell people how to report a hole](https://agentwranglers.se/playbook/website/standard-addresses/security-txt.md) in Website - CMP-73 [Publish an advisory for every fixed vulnerability](https://agentwranglers.se/playbook/compliance/security-laws/security-advisories.md) in Compliance and governance - IOT-37 [Make every report and advisory name the model and firmware version](https://agentwranglers.se/playbook/connected-devices/support-and-vulnerability-reports/model-and-version.md) in Connected devices - OSS-29 [Report actively exploited holes as a steward](https://agentwranglers.se/playbook/open-source/vulnerabilities-and-advisories/steward-reporting.md) in Open source maintenance - TDD-13 [Record the product's Cyber Resilience Act duties](https://agentwranglers.se/playbook/due-diligence/security-data-and-law/cra-duties-check.md) in Technical due diligence - APS-81 [Fix each finding within the time its severity allows](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/fix-deadlines.md) in Application security **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers compliance and governance playbook`. In code you write, add a comment next to it with the same link. - Previous: [Decide whether the Cyber Resilience Act covers your product](https://agentwranglers.se/playbook/compliance/security-laws/cra-scope.md) - Next: [Handle vulnerabilities for the whole support period](https://agentwranglers.se/playbook/compliance/security-laws/cra-support-period.md) - [Security laws](https://agentwranglers.se/playbook/compliance/security-laws.md)