ENISA, the EUVD, and CRA reporting
ENISA operates the reporting and vulnerability infrastructure at the centre of the Cyber Resilience Act. Here is how each touchpoint works and how the platform aligns with it.
ENISA's role under the CRA
Under Article 14 of the Cyber Resilience Act, a manufacturer that becomes aware of an actively exploited vulnerability in a product with digital elements must notify the coordinating CSIRT and ENISA through a single reporting platform. An early warning is due within 24 hours, a fuller notification within 72 hours, and a final report once the vulnerability is handled. ENISA also runs the European Vulnerability Database, the EU's public record of critical and exploited vulnerabilities.
CVD Portal is an independent platform and is not affiliated with or endorsed by ENISA or the EU. It aligns with these touchpoints so a manufacturer can meet the obligation with less manual effort.
ENISA also publishes engineering guidance, separately from its reporting infrastructure role. The Secure by Design and Default Playbook is 22 playbooks covering product security across the life cycle, mapped there to the Annex I requirements each one evidences.
Getting access to the SRP
ENISA published the operational guidance for the Single Reporting Platform on 31 July 2026, as separate documents covering authorised-representative user registration and notification submission, plus a two-page reporting factsheet. Three points from it change how manufacturers should prepare.
- Access runs through EU Login. You sign in to the platform with a European Commission EU Login account, and the account can be created now. This applies to manufacturers and to the authorised representatives of open-source software stewards alike.
- Your coordinating CSIRT validates your reporters. ENISA states that the CSIRT designated as coordinator confirms that a representative may submit on behalf of a specific manufacturer, and that this happens after first access rather than as a box you can tick in advance.
- There is no submission API. ENISA states that no application programming interfaces will be provided at this stage. Every notification is filed by a person, inside a 24-hour window that can open at any hour.
The platform is scheduled to be operational by 11 September 2026, the same day the reporting obligation starts to apply, so there is no period in which to learn it under no pressure. ENISA SRP guidance and FAQ.
Touchpoints and platform alignment
ENISA Single Reporting Platform
Where manufacturers file the Article 14 notifications for actively exploited vulnerabilities and severe incidents.
The platform runs the full Article 14 cascade: early warning within 24 hours, notification within 72 hours, and a final report, each with its own deadline timer. It generates a pre-filled ENISA submission package ready to paste into the Single Reporting Platform.
European Vulnerability Database (EUVD)
ENISA's public database of vulnerabilities, including critical and actively exploited entries.
CVD Portal pulls the live EUVD feeds directly from ENISA and uses them for monitoring and impact assessment against your SBOM. The feed below is the same source.
National CSIRTs
The Article 14 notification also goes to the CSIRT designated as coordinator in the manufacturer's member state.
The platform derives the correct national CSIRT and its Article 14 contact from a per-country directory, so the notification is routed to the right coordinator.
CSAF 2.0 advisories
Machine-readable security advisories that align with the EU move toward automated vulnerability information exchange.
CVD Portal generates CSAF 2.0 VEX advisories and publishes a provider metadata feed, so disclosures are machine-readable for downstream consumers.
EU Vulnerability Database (EUVD) Pulse
Official feed of the latest critical and actively exploited vulnerabilities tracked by European authorities.
Latest Critical Vulnerabilities
CVSS 9.0+A security vulnerability has been detected in RedPort Optimizer wXa-203, Optimizer wXa-213 and Optimizer wXa-223 up to 20260704. This impacts the function exec of the file /xgatev1/system/datetime.php of the component System Clock. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain NTP configuration and current time data via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Dell PowerStore SDNAS contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access.
An issue in the NetStaX EtherNet/IP Stack prior to v5.6.1 could allow a large Class 3 explicit-message request to exceed the application-side receive buffer without generating an error or warning. The result could be memory corruption, a device crash, or a potential remote attack vector without the originating device receiving a CIP error indicating that the request could not be processed.
Actively Exploited (KEV)
In the wildAn unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.
Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.
In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 ("ipv6: avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.
Be ready for the 24-hour clock
Run Article 14 reporting with deadline timers and a pre-filled ENISA submission package.