The case
Nordmann Elektronikk AS, a Norwegian company, makes the NE Gateway 4, an industrial gateway sold in Sweden, Denmark, Finland and Germany through a Swedish importer. On Tuesday 13 October 2026 at 08:40, a Swedish customer reports that settings on several of its gateways were changed overnight, and nobody on their side did it.
By 11:05 the team has found requests in the customer’s logs that reach the management interface without logging in, and has reproduced the bypass on firmware 4.2.1 in the lab. That is when they become aware: they are reasonably certain a vulnerability in their product is being exploited (when the clock starts). The early warning is due by 11:05 on Wednesday.
The company has no establishment or authorised representative in the EU, so the Article 14(7) route ends at the importer: the report goes to the CSIRT designated as coordinator in Sweden. The route finder works this out for any product.
The early warning, field by field
These are the fields the platform requires for an actively exploited vulnerability (SRP glossary), with what Nordmann Elektronikk enters:
| Field | What they enter |
|---|---|
| Notification type | Actively Exploited Vulnerability |
| Title | Active exploitation of an authentication bypass in NE Gateway 4 |
| Summary | A customer reported unauthorised configuration changes on NE Gateway 4 units on 13 October 2026. Our initial assessment confirms that an authentication bypass in the web management interface is being exploited to change settings without valid credentials. Firmware 4.0 to 4.2.1 is affected. A fix is in progress; until then, users should block access to the management interface from untrusted networks. |
| Manufacturer name | Nordmann Elektronikk AS (filled in by the platform) |
| Member States where product available | Sweden, Denmark, Finland, Germany. Sweden is shown as the coordinating CSIRT’s country. |
| Product Name | NE Gateway 4 |
| Product Version | 4.0 to 4.2.1 |
| Date and time when you become aware | 2026-10-13 09:05 UTC |
Three optional fields are worth filling in when you can:
- When the exploitation began: 2026-10-12 22:30 UTC (estimated), from the first unauthorised request in the customer’s logs. ENISA asks for estimates to be marked as such.
- Considered sensitivity of information: “The exploitation path is not yet public. Please limit technical details to the CSIRTs concerned until a fix is available.”
- CVE ID: left empty. None has been assigned yet, and the glossary says to leave the field empty rather than guess.
What stays out
- Exploit details and proof-of-concept code. ENISA asks for a title without confidential technical detail that isn’t needed to identify the issue.
- The customer’s name, and anything else that identifies a person.
- Guesses written as facts. Write what you know, and mark estimates.
One notification, three steps
The 72-hour notification and the final report aren’t new submissions. They are the next tabs of the same notification, which you can update as you learn more until the final report is in (SRP user manual, section 4.7). One notification covers the event, even for a group with several subsidiaries in the EU.
- Vulnerability notification, by 11:05 on Friday 16 October: a general description of the vulnerability and how the exploit works becomes required, with the measures taken, what users can do, and how sensitive the information is.
- Final report, no later than 14 days after the fix is available: a description of the vulnerability with its severity and impact, the security update or other measures, what users can do, and what is known about the attacker.
Watch the counter. In the current release, the platform shows the 72-hour notification as due 48 hours after you submit the early warning, so it can show as overdue early (SRP FAQ). The deadline in the CRA is 72 hours from when you became aware.
Tell the affected customers too (Article 14(8)). While the hole is open, that can be a direct message to the customers concerned rather than a public notice (Commission guidance, point 220). What each report must contain is in the CRA playbook.
Have this ready before you need it
- Two people registered in the platform, each with an EU Login account and multi-factor authentication, and your company registered as manufacturer.
- Your Article 14(7) route, so you know which CSIRT is yours. It counts all your products, so it’s one CSIRT for the company.
- Exact product names and version ranges, and the EU countries each product is sold in.
- A draft summary to start from, so the first 24 hours go to the assessment, not the wording.
