How to report an actively exploited vulnerability from Jira
Since 11 September 2026, a manufacturer that learns that a vulnerability in its product is being actively exploited has 24 hours to send an early warning through ENISA’s Single Reporting Platform. Here is how to decide, who receives the report, what each report contains, and how to run the case from the Jira work item where the vulnerability already lives.
Is it actively exploited?
The Cyber Resilience Act (Regulation (EU) 2024/2847, Article 3(42)) defines an actively exploited vulnerability as one for which there is reliable evidence that a malicious actor has exploited it in a system without the owner’s permission. A high severity score is not evidence of exploitation, and neither is a proof of concept.
Write down what the evidence is, where it comes from and who assessed it, for example a customer or a CSIRT reporting an intrusion through the flaw, or your own logs. The decision, and the moment you took it, are part of your record.
Who receives the report
You submit one notification through ENISA’s Single Reporting Platform, open since 11 September 2026. It reaches the CSIRT designated as coordinator in the Member State of your main establishment in the EU, and ENISA at the same time (Article 14(7)). Without an EU establishment, Article 14(7) sets the order to follow: your authorised representative, then your importer, then your distributor, then where most of your users are.
Each person who reports needs a personal EU Login account with multi-factor authentication. Make sure they have one before the first case; ENISA asks manufacturers to register on the platform itself when they have something to notify. At launch the platform is in English only.
The three reports
Each clock starts when you become aware of the exploitation, not when your analysis ends. Record that moment, and how you learned of it.
- Early warning: within 24 hours. That the vulnerability exists and, where applicable, the Member States where you know the product has been made available.
- Vulnerability notification: within 72 hours. General information about the product, the general nature of the exploit and of the vulnerability, the corrective or mitigating measures taken and those users can take, and how sensitive you consider the information.
- Final report: no later than 14 days after a corrective or mitigating measure is available. A description of the vulnerability with its severity and impact, information on the malicious actor where available, and details of the security update or other corrective measures.
A severe incident that affects the security of your product follows the same 24-hour and 72-hour steps, with a final report one month after the notification: see our guide to CRA reporting in Jira.
Inform your users
Article 14(8) also asks you to inform the impacted users, and where appropriate all users, about the vulnerability and the mitigation or corrective measures they can apply, where appropriate in a structured, machine-readable format. A CSAF security advisory is one such format.
Before the first case: what to have ready
- An SBOM for each version on the market, to find in minutes which products contain the component.
- The Member States where each product is made available, because the early warning asks for them.
- Who reports: EU Login accounts with multi-factor authentication, and the CSIRT that coordinates for you.
- A rule for the decision “actively exploited or not”, and who signs it.
- One place for the case: the work item where the vulnerability already is, with the moment of awareness, each report sent, the reference ENISA gives you and the fix.
Step by step from Jira with Clearlane CRA
- On the vulnerability’s work item, open the CRA panel. The package, CVE and affected range are read from it, and the products whose SBOM contains the component are proposed.
- Qualify the case with your signature: actively exploited or not, and when you became aware of it. The clocks start, and the early warning lists the Member States recorded for each product.
- Copy each prepared report into ENISA’s platform, then record when you submitted it and the reference you received. The app never submits anything on your behalf.
- Record the fix, the notice to users and the advisory, with a CSAF file attached to the work item.
- Close the case with a signature and keep the PDF evidence file with your technical documentation.
Sources: Regulation (EU) 2024/2847, Articles 3(42), 14 and 71 (EUR-Lex); ENISA, Single Reporting Platform FAQ. Checked on 13 October 2026.
Clearlane CRA helps manufacturers meet the reporting requirements of the Cyber Resilience Act; your own assessment still applies. See how Clearlane CRA works →