CVE
Almost every known vulnerability has a number in the format CVE-year-number. The number makes it possible to talk about the same flaw. But it says nothing about whether the flaw can be reached in your product or is being exploited.
CVE (Common Vulnerabilities and Exposures) is the identifier used worldwide for publicly known vulnerabilities, such as CVE-2026-12345. It identifies a vulnerability unambiguously, but does not rate it and says nothing about whether it is being exploited.
Definition in the Regulation
The Regulation does not define the term; CVE is a technical standard, not a legal concept. In Article 3, points (40) to (42), Regulation (EU) 2024/2847 defines vulnerability, exploitable vulnerability and actively exploited vulnerability. Only the last of these must be notified under Article 14(1). In paragraphs 230 to 235 (on known exploitable vulnerabilities under Annex I, Part I, point (2)(a)), the Commission guidance C(2026) 5252 makes clear that the mere fact that a vulnerability is listed in a public database or has been found does not mean that it is exploitable in practice or relevant to the specific product. Among the databases it names is the European vulnerability database (EUVD).
What it means for manufacturers
A new CVE entry for a library in your SBOM is a reason to investigate, not the trigger for the 24-hour deadline. You need to check whether the vulnerable code can be reached in your product and whether there are signs of actual exploitation. Reporting every CVE overloads you and the CSIRT; dismissing customer reports of strange access as a support case means missing the deadline. On ENISA's reporting platform, the CVE ID and EUVD ID are optional fields in the early warning. For your own disclosure under Annex I, Part II, point (4), BSI TR-03183-3 recommends publishing fixed vulnerabilities at least in the EUVD; assigning a CVE belongs in the CVD policy.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitRelated terms
- Vulnerability
- CVSS
- Actively exploited vulnerability
- Software bill of materials (SBOM)
- Security advisory