When this template applies
Use it only on the actively exploited vulnerability track. Article 3(42) defines that as a vulnerability with reliable evidence that a malicious actor has exploited it in a system without the owner's permission. When the vulnerability track applies. For severe incidents, see the severe incident notification guide or the full Article 14 report template.
What Article 14(2)(b) asks for
Unless already provided, the vulnerability notification must give general information, as available, about the product concerned, the general nature of the exploit and of the vulnerability, corrective or mitigating measures taken, and corrective or mitigating measures users can take, and must indicate, where applicable, how sensitive the manufacturer considers the notified information to be.
Due without undue delay and within 72 hours of becoming aware. Background: CRA 72-hour notification guide.
Copyable template
CRA ARTICLE 14 — VULNERABILITY NOTIFICATION (Art 14(2)(b)) Actively exploited vulnerability — due without undue delay, within 72 hours of becoming aware (unless the relevant information has already been provided) CASE - Case ID / internal reference: - Product with digital elements: - Versions / builds / firmware / components affected: - Awareness date and time (manufacturer): - Early warning submitted (date/time, SRP reference): - Coordinating CSIRT (Art 14(7)): - Assigned Representative submitting: ARTICLE 14(2)(b) FIELDS - Product and versions affected: - General nature of the exploit: - General nature of the vulnerability: - Corrective or mitigating measures taken: - Corrective or mitigating measures users can take: - How sensitive we consider this information (where applicable): OPTIONAL PREP (often useful on the SRP; not listed in Art 14(2)(b)) - CVE ID / EUVD ID (where available): - Member States where the product has been made available (if not already in early warning): - Link to user notice / advisory (Art 14(8)): - Evidence log location: NEXT CLOCK - Corrective or mitigating measure available? (date/time or "not yet"): - Final report due: no later than 14 days after a measure is available (Art 14(2)(c))
How to use it
- Agree the wording outside the SRP first; saved drafts there are not a team workspace.
- Write “unknown so far” with an owner rather than leaving a field blank.
- Enter the agreed text into the fields ENISA shows you; the platform may require extra fields (for example CVE or EUVD IDs). SRP fields checklist
- Keep the early warning and this notification consistent on product and versions. 24-hour early warning
- When a corrective or mitigating measure is available, start the 14-day final-report clock. Final report checklist
Questions people ask
- What is the CRA vulnerability notification?
- The second step on the actively exploited vulnerability track under Article 14(2)(b). After the 24-hour early warning, the manufacturer submits a vulnerability notification without undue delay and within 72 hours of becoming aware, unless the relevant information has already been provided.
- Is this an official ENISA form?
- No. You submit through ENISA's Single Reporting Platform, whose fields adapt by stage. This template follows Article 14(2)(b) so you can prepare and agree the content before you open the platform.
- Does this template cover severe incidents?
- No. Severe incidents use Article 14(4)(b) (incident notification). Use the full Article 14 report template for both tracks, or the severe-incident guide for that path.
- When is the vulnerability notification due?
- Without undue delay and in any event within 72 hours of the manufacturer becoming aware of the actively exploited vulnerability, unless the relevant information has already been provided.
- Can the free desk fill this in for my case?
- Yes. Log a vulnerability case with awareness time and product, then download draft 24-hour, 72-hour and final-report text with case details and deadlines filled in.