Corriger ou atténuer: le CRA ne prévoit que deux réponses

Summary

Since 11 September 2026, manufacturers have had to report an actively exploited vulnerability in their products, third-party libraries included, in three stages: an early warning within 24h, a notification within 72h, then a final report whose deadline runs as soon as a corrective or mitigating measure is available. I argue that the 24h deadline is won or lost well before the incident: in the delivery chain, in the number of versions a vendor agrees to maintain, in whether products can be mitigated without a developer, and in the decision whether to place a product on the European market at all. The article sets out a roadmap for the installed base and for new products, and the golden rules I set for R&D.

Key ideas

• The 11 September obligations set no deadline for fixing a vulnerability. They require reporting it, and a mitigating measure is enough to start the countdown to the final report.
• A flaw in a library built into a product is a flaw in that product: reporting falls to the vendor, whether the library’s maintainer responds or not. In the Commission’s reading, the vendor must report only when the flaw is exploited in its own product. An abandoned dependency turns a single flaw into N parallel fixes, across everyone who ships it.
• Every maintained version adds a pipeline, an SBOM, a fix and a report to file. Maintaining fewer versions requires a new support model. Ending support stops the fixes; the duty to report carries on. A product for which these costs exceed what it earns should not be placed on the European market, and that decision is taken before it is first made available there, whether sold or given away.
• The ability to mitigate is designed, not improvised: every exposed feature can be switched off by configuration, without a new release, with a switch tested in every version and a mitigation playbook written in advance.
• Early warnings and notifications are not public: they circulate between CSIRTs, ENISA and market surveillance authorities. What leaves that circle is the information the manufacturer owes affected users, or all users where appropriate. If the manufacturer is too slow, the CSIRTs may deliver it themselves.

Why I wrote this