CVSS
A high CVSS score sounds dramatic, a low one reassuring. Neither counts for the reporting obligation. What matters is whether the flaw is being exploited. The score still has its place: in classification, in the notification and in the security advisory.
CVSS (Common Vulnerability Scoring System) is a scale that describes the severity of a vulnerability, based on technical characteristics, as a score between 0 and 10. It helps with prioritisation but is not a criterion for the reporting obligation under the Cyber Resilience Act.
Definition in the Regulation
The Regulation does not define the term; CVSS is a technical standard. In Article 14(1), Regulation (EU) 2024/2847 ties the reporting obligation solely to active exploitation within the meaning of Article 3, point (42), not to severity. Severity appears elsewhere. The vulnerability notification under Article 14(2)(b) does not mention severity; the final report under point (c) contains a description of the vulnerability, including its severity and impact, and the 72-hour notification of an incident under paragraph 4(b) contains an initial assessment of the incident. The publication of fixed vulnerabilities under Annex I, Part II, point (4) also covers severity.
What it means for manufacturers
A vulnerability with a low CVSS score that an attacker is demonstrably exploiting must be reported; one with a score of 9.8 and no evidence of exploitation need not be. The score is useful for internal triage: which report gets looked at first, which flaw gets closed first. In its CVD policy, the manufacturer should state which CVSS version it uses and how it derives internal severity levels from it. In a machine-readable security advisory in CSAF format, the CVSS score is a standard field. The order still matters: first check whether the flaw is being exploited, then assess how severe it is.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit