Vulnerability

A vulnerability is a weakness, susceptibility or flaw of a product with digital elements that an attacker can exploit. It is the basic concept on which the vulnerability handling and reporting obligations of the Cyber Resilience Act are built.

Definition in the Regulation

Article 3, point (40), of Regulation (EU) 2024/2847 defines the term:

a weakness, susceptibility or flaw of a product with digital elements that can be exploited by a cyber threat

Article 3, point (40) CRA

Two narrower terms build on this. Under point (41), an exploitable vulnerability is one that "has the potential to be effectively used by an adversary under practical operational conditions". Under point (42), an actively exploited vulnerability is one for which there is reliable evidence that a malicious actor has exploited it in a system without the permission of the system owner. Only this third level must be reported under Article 14(1).

What it means for manufacturers

Vulnerability handling under Annex I, Part II, applies to all vulnerabilities: address and remediate them without delay and provide security updates (point (2)), publish information about the fixed vulnerability once the update is available (point (4)) and provide a contact address for reports (point (6)). If the vulnerability is in a component sourced from a third party, the manufacturer reports it to the component's manufacturer under Article 13(6). These obligations apply from 11 December 2027. An entry in a vulnerability database or a scanner finding does not yet mean that the vulnerability can be exploited in your own product; the Commission guidance C(2026) 5252 makes this explicit in paragraphs 230 to 235.

Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit

Related terms

• Actively exploited vulnerability
• CVE
• CVSS
• Security update
• Coordinated vulnerability disclosure (CVD)

Learn more

• Actively exploited vulnerability: what must be reported and what need not beThe distinction between vulnerability, exploitability and exploitation, with examples.