Actively exploited vulnerability
Not every flaw has to be reported, only one that is actually being exploited. The Regulation requires reliable evidence of this. A database entry, a scanner finding or a researcher's exploit is not enough.
An actively exploited vulnerability is a vulnerability for which there is reliable evidence that a malicious actor has exploited it in a system without the owner's permission. Together with the severe incident, it triggers the reporting obligation under Article 14.
Definition in the Regulation
Article 3, point (42), of Regulation (EU) 2024/2847 reads:
a vulnerability for which there is reliable evidence that a malicious actor has exploited it in a system without permission of the system owner
Article 3, point (42) CRA
Under Article 14(1), the manufacturer must notify any actively exploited vulnerability contained in its product that it becomes aware of. Recital 68 gives the example of a security breach affecting users that results from a malicious actor making use of a flaw in the product. The same recital excludes from mandatory notification vulnerabilities discovered for the purposes of "good faith testing, investigation, correction or disclosure".
What it means for manufacturers
Three things are not an actively exploited vulnerability on their own: a CVE entry, a CVSS score and a proof of concept without evidence of real-world exploitation. Exploitation at a single customer, on the other hand, is enough, because the definition refers to "a system". If the vulnerability sits in a third-party component, it must be reported if it is contained in your own product and exploited there. If the vulnerable code cannot be reached in your product, or has not been exploited there, you report it to the component's manufacturer and, where appropriate, make a voluntary notification (Commission guidance C(2026) 5252, paragraph 218). Because a manufacturer only knows after an initial assessment whether a report crosses this threshold, every incoming report has to be looked at straight away.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit