The situation
A manufacturer has sent its early warning and vulnerability notification while engineering prepares a fix. The record first shows no available measure. When a corrective measure becomes available, its availability date and details become evidence for the final-report sequence.
Facts that change the answer
- Has a corrective or mitigating measure become available?
- What is the evidenced availability date?
- Which measure details and user actions are ready to report?
Compare the worked results
These examples use the published assessment with the assumptions shown below. Change the facts in your own assessment before relying on its result.
Initial notifications sent; no available measure yet
Hypothetical example 1
Key facts in this example
- A corrective or mitigating measure is available
- No
All recorded assumptions (13)
- Affected product with digital elements
- Hypothetical example product
- Reporting role
- manufacturer
- Timestamp when the organisation became aware of the vulnerability
- 2026-09-11T09:00:00Z
- Evidence that a malicious actor is exploiting the vulnerability in a system without the system owner’s permission
- confirmed
- 24-hour early-warning status
- submitted within 24 hours
- 72-hour vulnerability-notification status
- submitted within 72 hours
- The notification records, where applicable, Member States where the product is known to have been made available
- Yes
- The 72-hour notification records available product information and the general nature of the exploit and vulnerability
- Yes
- A corrective or mitigating measure is available
- No
- Corrective or mitigating measures taken, and measures users can take, are recorded
- Yes
- The notification records how sensitive the submitted information is, where applicable
- Yes
- Impacted users were informed without undue delay, including necessary risk-mitigation or corrective measures
- Yes
- Submission to the designated coordinating CSIRT and ENISA is confirmed
- Yes
Measure available; final report being prepared
Hypothetical example 2
Key facts in this example
- A corrective or mitigating measure is available
- Yes
- Date the corrective or mitigating measure became available
- 2026-09-12
- Final-report status within 14 days after a corrective or mitigating measure became available
- deadline not yet reached
All recorded assumptions (15)
- Affected product with digital elements
- Hypothetical example product
- Reporting role
- manufacturer
- Timestamp when the organisation became aware of the vulnerability
- 2026-09-11T09:00:00Z
- Evidence that a malicious actor is exploiting the vulnerability in a system without the system owner’s permission
- confirmed
- 24-hour early-warning status
- submitted within 24 hours
- 72-hour vulnerability-notification status
- submitted within 72 hours
- The notification records, where applicable, Member States where the product is known to have been made available
- Yes
- The 72-hour notification records available product information and the general nature of the exploit and vulnerability
- Yes
- A corrective or mitigating measure is available
- Yes
- Date the corrective or mitigating measure became available
- 2026-09-12
- Corrective or mitigating measures taken, and measures users can take, are recorded
- Yes
- The notification records how sensitive the submitted information is, where applicable
- Yes
- Final-report status within 14 days after a corrective or mitigating measure became available
- deadline not yet reached
- Impacted users were informed without undue delay, including necessary risk-mitigation or corrective measures
- Yes
- Submission to the designated coordinating CSIRT and ENISA is confirmed
- Yes
Evaluated on 2026-09-13 using EU Cyber Resilience Act actively exploited vulnerability notification record, version 2026.09.02. A completed example is not a customer Record or a declaration of conformity.
Evidence to keep
- Early-warning and notification receipts
- Measure availability and release evidence
- Final-report content and impacted-user communication
Keep source artifacts in their controlled systems and record their references, responsible owner and review date with the decision.
Your next step
Record the measure’s actual availability and prepare the final report. Use the calculator to plan the outside limit, while acting without undue delay.
Choose your real product or vulnerability case in the workspace. The selected assessment will be highlighted; example answers are not copied into your record.
Sources and application dates
- Regulation (EU) 2024/2847 (Cyber Resilience Act)Article 14(1), (2), (7) and (8), Article 24(3), and Article 71(2)
- European Commission CRA reporting obligationsSingle Reporting Platform, reporting scope and application date
Manufacturer reporting applies from 11 September 2026. Broader product requirements apply from 11 December 2027; these product-readiness examples support preparation. Open-source-steward obligations have their own application date.
These examples structure a decision and do not replace the Regulation, official guidance or product-specific professional advice. Not lawyer-reviewed.