Notify actively exploited vulnerabilities and severe incidents
- Dotyczy
- Open-source steward
- Cytowania źródeł
- Art. 24(2)
- Klasy produktów
- default, important-class-i, important-class-ii, critical
Prosty język
If you become aware that a vulnerability in your OSS is actively being exploited in the wild, or that a severe security incident has affected your software, you must notify the relevant CSIRT coordinator without undue delay. This is a lighter obligation than the manufacturer's 24-hour reporting window under Art. 14, but "without undue delay" still means promptly — days, not weeks. The CSIRT will coordinate the response and help with vulnerability disclosure.
Legal text
Article 24(2) of Regulation (EU) 2024/2847 provides that open-source software stewards shall notify, without undue delay and in any event within the timeframe established by implementing acts, the CSIRT designated as coordinator pursuant to Article 12(1) of Directive (EU) 2022/2555 of:
- any actively exploited vulnerability contained in the open-source software components they administer; and
- any severe incident having an impact on the security of those open-source software components.
Following notification, the CSIRT shall treat the reported information confidentially and support the open-source software steward in disclosing the vulnerability in accordance with coordinated vulnerability disclosure practices.
Key requirements
- Trigger: active exploitation — duty arises when you become aware that a vulnerability in your software is actively exploited in the wild
- Trigger: severe incident — duty also arises for severe security incidents affecting the software's security properties
- Recipient: CSIRT coordinator — notify the national CSIRT designated as coordinator under NIS 2 Directive Art. 12, not ENISA directly
- Without undue delay — prompt notification; the exact deadline will be set by implementing act
- Confidentiality — the CSIRT handles reported information confidentially and supports coordinated disclosure
Evidence you may need
- Notification sent to CSIRT coordinator (date, content, method)
- Internal process for monitoring and detecting active exploitation
- Incident log documenting when awareness was gained and actions taken
- Coordinated disclosure timeline