13 advisories, 0 reporting triggers: severity is not exploitation under the EU CRA

Описание и применение

Команды часто ошибочно считают, что все критические CVE из сканера – это требования к уведомлению по EU CRA. На деле только те, которые находятся в KEV, действительно требуют отчёта. Используя инструмент cra‑watch для пересечения списков и регулярного запуска, можно быстро определить реальную нагрузку и избежать избыточных уведомлений.

Задача

Teams misinterpret vulnerability scanner output as the trigger for EU Cyber Resilience Act (CRA) reporting, leading to over‑reporting and wasted effort.

Результат

By intersecting advisories with KEV and scheduling the check, teams can focus on a short list of true reporting triggers, avoid over‑reporting, and comply with CRA requirements efficiently.

Рабочий процесс

• Run a dependency scan to list all components with advisories.
• Intersect the advisory list with the KEV catalogue to identify actively exploited vulnerabilities.
• Schedule the intersection run regularly (e.g., CI pipeline) rather than on push.
• Define a clear decision owner for reporting before the 24‑hour clock starts.
• Document the decision and its timing for audit purposes.

Доказательства

Thirteen components with published advisories. Zero on the known‑exploited list.

Источник

One component. Two known‑exploited CVEs. That's the one that deserves a human in the room.

Источник