What “actively exploited” means
A vulnerability is actively exploited when there is reliable evidence that a malicious actor has exploited it in a system without the owner’s permission (Article 3(42)). Being exploitable isn’t enough. A vulnerability an attacker could use under real conditions is an exploitable vulnerability (Article 3(41)), and it doesn’t trigger the reporting duty.
Recital 68 describes actively exploited vulnerabilities as cases where the manufacturer establishes that a security breach resulted from someone using a flaw in one of its products. Weaknesses in identification and authentication are the Regulation’s own example.
When the clock starts
The deadlines run from when you become aware that the vulnerability is being exploited. The Commission’s guidance says when that is (point 213): if you notice something suspicious, or a customer, researcher, authority or the media tells you, you assess it straight away. You’re regarded as aware when, after that initial assessment, you’re reasonably certain that a vulnerability in your product is being exploited.
That means two things:
- The clock doesn’t wait for the investigation to finish. The early warning only needs what you know, and you add to it in the 72-hour notification and the final report (point 215).
- The initial assessment can’t be dragged out. The guidance stresses doing it promptly, especially when the vulnerability could pose a significant risk (point 214).
The 24 hours run through weekends and holidays too. The deadlines, and what each report must contain, are in the CRA playbook.
KEV, EUVD and other sources
A vulnerability in CISA’s KEV catalogue, or marked as exploited in the EUVD, has been exploited somewhere. That doesn’t make it reportable for you by itself. The guidance says a vulnerability is reportable when it’s contained in your product and exploited there (point 218).
Treat the listing as a reason to assess straight away:
- Is the vulnerable component or code in your product, in an affected version?
- Can the vulnerability be reached and exploited the way the product is built and used?
- Is there any sign of it being exploited in your product: customer reports, logs, a CSIRT getting in touch, threat intelligence naming the product?
If the answer to the first or second question is no, it isn’t reportable. If the answer to the third is yes, it is, and the clock runs from then. If your own product is in the KEV, or a customer reports a compromised device, you’re usually aware already.
Vulnerabilities in components
Much of the code in a product comes from others: open source, SDKs and suppliers’ firmware. The guidance is clear (point 218):
- If a vulnerability from a third-party component is exploited in your product, you report it.
- If it can’t be exploited in your product, because the vulnerable code isn’t reachable for example, or it hasn’t been exploited there, it isn’t reportable for you.
From 11 December 2027 you can report such vulnerabilities voluntarily (Article 15). For products placed on the market from then on, you must also report upstream to whoever maintains the component (Article 13(6)).
Findings from testing and research
Vulnerabilities found in good faith, through testing, investigation, correction or disclosure, aren’t to be reported (recital 68). A finding from a penetration test you commissioned, or from a bug bounty programme, isn’t actively exploited as long as nothing suggests anyone exploited it before.
If a researcher tells you the vulnerability is already being exploited, that’s a tip to assess like any other.
What happened before 11 September 2026
If you knew before 11 September 2026 that a vulnerability was being exploited, you don’t have to report it after the fact. If you only knew about the vulnerability, and you learn of exploitation after that date, the duty applies (point 217).
Write the assessment down
Whatever you conclude: note when the tip came in, what you checked, what you concluded and when. A supervisory authority can ask when you became aware, and that note is what shows the clock started at the right time.
