CRA vulnerability management — findings, triage and remediation
A component match starts an investigation. Human triage determines relevance and the next action for the actual product and release.
Keep findings and decisions separate
Retain the source, lookup time, component and version match. Record affectedness, exploitability uncertainty and the reviewer. VEX is a supported decision record, not an automatic exemption from reporting.
Remediation with deployment context
Assign owner and target date, link the corrective release or backport and retain tests and deployment evidence. A patch being available is different from a patch reaching every affected customer.
Article 14 escalation
Review credible evidence of active exploitation and severe-incident criteria independently of scanner severity. Preserve awareness and reporting clocks. A low CVSS label is not a legal no-report decision.
Next steps
Official sources and review context
Regulation (EU) 2024/2847 · European Commission · ENISA SRP
CRA-I18N-2026-10-14-DRAFT-4
Operational tools and retained records. No legal opinion, conformity assessment, certification or confirmation of CRA compliance is generated.