Exploited vulnerabilities

When does the CRA vulnerability final-report clock start?

The vulnerability final report is tied to availability of a corrective or mitigating measure. It should not be calculated as a fixed interval from the initial awareness timestamp.

Prepared by CRA Operations · Updated 2026-09-13 · Hypothetical worked examples

The situation

A manufacturer has sent its early warning and vulnerability notification while engineering prepares a fix. The record first shows no available measure. When a corrective measure becomes available, its availability date and details become evidence for the final-report sequence.

Facts that change the answer

  • Has a corrective or mitigating measure become available?
  • What is the evidenced availability date?
  • Which measure details and user actions are ready to report?

Compare the worked results

These examples use the published assessment with the assumptions shown below. Change the facts in your own assessment before relying on its result.

Initial notifications sent; no available measure yet

Hypothetical example 1

Assessment resultnotification sequence in progress
Key facts in this example
A corrective or mitigating measure is available
No
All recorded assumptions (13)
Affected product with digital elements
Hypothetical example product
Reporting role
manufacturer
Timestamp when the organisation became aware of the vulnerability
2026-09-11T09:00:00Z
Evidence that a malicious actor is exploiting the vulnerability in a system without the system owner’s permission
confirmed
24-hour early-warning status
submitted within 24 hours
72-hour vulnerability-notification status
submitted within 72 hours
The notification records, where applicable, Member States where the product is known to have been made available
Yes
The 72-hour notification records available product information and the general nature of the exploit and vulnerability
Yes
A corrective or mitigating measure is available
No
Corrective or mitigating measures taken, and measures users can take, are recorded
Yes
The notification records how sensitive the submitted information is, where applicable
Yes
Impacted users were informed without undue delay, including necessary risk-mitigation or corrective measures
Yes
Submission to the designated coordinating CSIRT and ENISA is confirmed
Yes

Measure available; final report being prepared

Hypothetical example 2

Assessment resultnotification sequence in progress
Key facts in this example
A corrective or mitigating measure is available
Yes
Date the corrective or mitigating measure became available
2026-09-12
Final-report status within 14 days after a corrective or mitigating measure became available
deadline not yet reached
All recorded assumptions (15)
Affected product with digital elements
Hypothetical example product
Reporting role
manufacturer
Timestamp when the organisation became aware of the vulnerability
2026-09-11T09:00:00Z
Evidence that a malicious actor is exploiting the vulnerability in a system without the system owner’s permission
confirmed
24-hour early-warning status
submitted within 24 hours
72-hour vulnerability-notification status
submitted within 72 hours
The notification records, where applicable, Member States where the product is known to have been made available
Yes
The 72-hour notification records available product information and the general nature of the exploit and vulnerability
Yes
A corrective or mitigating measure is available
Yes
Date the corrective or mitigating measure became available
2026-09-12
Corrective or mitigating measures taken, and measures users can take, are recorded
Yes
The notification records how sensitive the submitted information is, where applicable
Yes
Final-report status within 14 days after a corrective or mitigating measure became available
deadline not yet reached
Impacted users were informed without undue delay, including necessary risk-mitigation or corrective measures
Yes
Submission to the designated coordinating CSIRT and ENISA is confirmed
Yes

Evaluated on 2026-09-13 using EU Cyber Resilience Act actively exploited vulnerability notification record, version 2026.09.02. A completed example is not a customer Record or a declaration of conformity.

Evidence to keep

  • Early-warning and notification receipts
  • Measure availability and release evidence
  • Final-report content and impacted-user communication

Keep source artifacts in their controlled systems and record their references, responsible owner and review date with the decision.

Your next step

Record the measure’s actual availability and prepare the final report. Use the calculator to plan the outside limit, while acting without undue delay.

Choose your real product or vulnerability case in the workspace. The selected assessment will be highlighted; example answers are not copied into your record.

Sources and application dates

Manufacturer reporting applies from 11 September 2026. Broader product requirements apply from 11 December 2027; these product-readiness examples support preparation. Open-source-steward obligations have their own application date.

These examples structure a decision and do not replace the Regulation, official guidance or product-specific professional advice. Not lawyer-reviewed.

Related situations