[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZpksOL8iObosF0NhTdWnfbky4iz7crn2aG8NwIyQm5A":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":51},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"c078c200-5917-4457-9ca2-f84997d05663","The EU CRA's Real Question: What Shipped, and When Did You Know?","the-eu-cra-s-real-question-what-shipped-and-when-did-you-know-c5c4ae","The EU Cyber Resilience Act's vulnerability reporting requirements take effect September 11, giving software vendors as little as 24 hours to report actively exploited flaws. ActiveState explains why knowing exactly what shipped and when vulnerabilities were discovered will be critical to meeting the new requirements. [...]","The EU Cyber Resilience Act (CRA) will soon require software vendors selling into the EU to report actively exploited vulnerabilities within 24 hours of discovery. This new regulation, effective September 11, 2026, shifts the burden from informal volunteer processes to legal obligations for many companies. The CRA also mandates current Software Bills of Materials (SBOMs), emphasizing the critical need for vendors to accurately track what software components have shipped and when vulnerabilities were identified.","EU Cyber Resilience Act reporting requirements take effect Sept 11, demanding 24-hour vulnerability disclosures.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fthe-eu-cras-real-question-what-shipped-and-when-did-you-know\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fposts\u002F2026\u002F09\u002F08\u002Factivestate-what-shipped.jpg","2026-09-08T20:24:16+00:00","2026-09-08T22:00:24.719569+00:00",8,[17,20],{"name":18,"type":19},"ActiveState","vendor",{"name":21,"type":22},"EU Cyber Resilience Act","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"ef42c16c-f41b-4794-8148-5fa5cb7b41b0","Cyber Resilience Act","eu-cyber-resilience-act",[],[18,21],{"controls":49,"vendors":50},[],[],{"slug":52,"title":53,"body":54,"framework_refs":55,"framework_notes":66},"eu-cra-mandates-24-hour-vulnerability-disclosure-and-sboms-for-software-vendors","EU CRA Mandates 24-Hour Vulnerability Disclosure and SBOMs for Software Vendors","The EU Cyber Resilience Act (CRA), effective September 2026, transforms vulnerability disclosure from a voluntary best practice into a legal obligation, requiring vendors to report actively exploited vulnerabilities within 24 hours of discovery. Many organizations currently lack the internal processes, tooling, and supply chain visibility needed to meet this timeline consistently. The mandatory use of Software Bills of Materials (SBOMs) exposes a widespread gap: vendors often cannot accurately account for every component that has shipped in their products. Failure to comply carries significant legal and financial risk, making this a board-level concern rather than a purely technical one. Organizations that delay preparation will find themselves scrambling to retrofit compliance into immature vulnerability management programs.",[56,57,58,59,60,61,62,63,64,65],"EU Cyber Resilience Act (CRA) — Article 11 (Vulnerability Reporting Obligations)","EU Cyber Resilience Act (CRA) — Annex I (Essential Cybersecurity Requirements)","NIST SP 800-161r1 — Supply Chain Risk Management","NIST CSF 2.0 — GV.OC, ID.RA, RS.CO","CIS Control 2 — Inventory and Control of Software Assets","CIS Control 7 — Continuous Vulnerability Management","NTIA SBOM Minimum Elements Guidance","ISO\u002FIEC 27001:2022 — A.8.8 Management of Technical Vulnerabilities","GDPR Article 33 (Notification to supervisory authority — analogous disclosure timeline precedent)","CISA KEV (Known Exploited Vulnerabilities Catalog)",{}]