EU Cyber Resilience Act Sets 24-Hour Vulnerability Reporting Clock for 2026
Summary
An ActiveState-sponsored article explains the EU Cyber Resilience Act’s reporting deadlines and argues manufacturers need current SBOMs and software provenance to identify shipped products and report exploited vulnerabilities.
Key points
- The article says CRA reporting obligations begin September 11, 2026: manufacturers must notify ENISA within 24 hours of learning a product vulnerability is actively exploited, with a fuller report within 72 hours.
- The CRA’s engineering requirements are scheduled to apply from December 11, 2027.
- The author recounts receiving a report alleging 95 vulnerabilities in an open-source project; two or three were reportedly real, and a subsequent email demanded $100,000 to prevent publication.
- The article argues manufacturers need current SBOMs and records showing what shipped and when they learned of vulnerabilities.
- It describes automated SBOM generation, documented vulnerability-handling processes, and software provenance as ways organizations are preparing.
- The author discloses uncertainty about how strictly ENISA will enforce the reporting rules in the first year.
Article Details
- Event Type
- Sponsored article discussing the EU Cyber Resilience Act’s vulnerability-reporting obligations and the software visibility challenges illustrated by a maintainer’s extortionate vulnerability disclosure.
- Impact
- The report contained 95 purported vulnerabilities, of which two or three were found to be real. The maintainer was then asked to pay $100,000 or face public disclosure. The article says CRA reporting obligations begin September 11, 2026, requiring notification to ENISA within 24 hours of learning that a vulnerability is actively exploited and a fuller report within 72 hours; engineering requirements begin December 11, 2027. It highlights the difficulty of identifying shipped software and maintaining current SBOMs, and promotes ActiveState’s Curated Catalogs.