Notify actively exploited vulnerabilities and severe incidents

If you become aware that a vulnerability in your OSS is actively being exploited in the wild, or that a severe security incident has affected your software, you must notify the relevant CSIRT coordinator without undue delay. This is a lighter obligation than the manufacturer's 24-hour reporting window under Art. 14, but "without undue delay" still means promptly — days, not weeks. The CSIRT will coordinate the response and help with vulnerability disclosure.

Legal text

Article 24(2) of Regulation (EU) 2024/2847 provides that open-source software stewards shall notify, without undue delay and in any event within the timeframe established by implementing acts, the CSIRT designated as coordinator pursuant to Article 12(1) of Directive (EU) 2022/2555 of:

any actively exploited vulnerability contained in the open-source software components they administer; and
any severe incident having an impact on the security of those open-source software components.

Following notification, the CSIRT shall treat the reported information confidentially and support the open-source software steward in disclosing the vulnerability in accordance with coordinated vulnerability disclosure practices.

Key requirements

Trigger: active exploitation — duty arises when you become aware that a vulnerability in your software is actively exploited in the wild
Trigger: severe incident — duty also arises for severe security incidents affecting the software's security properties
Recipient: CSIRT coordinator — notify the national CSIRT designated as coordinator under NIS 2 Directive Art. 12, not ENISA directly
Without undue delay — prompt notification; the exact deadline will be set by implementing act
Confidentiality — the CSIRT handles reported information confidentially and supports coordinated disclosure

Evidence you may need

Notification sent to CSIRT coordinator (date, content, method)
Internal process for monitoring and detecting active exploitation
Incident log documenting when awareness was gained and actions taken
Coordinated disclosure timeline