Checking EU Cyber Resilience Act 24‑hour reporting trigger with cra‑watch

Description and use

Teams need to quickly determine if a vulnerability in their product is actively exploited to meet the 24‑hour reporting deadline under EU CRA. The cra‑watch tool automatically checks dependencies, compares them with OSV.dev and the CISA KEV catalog, and outputs a report of matches and guidance for next steps.

Problem

Teams need to know if a vulnerability in their product is actively exploited to trigger the EU CRA 24‑hour early‑warning reporting clock.

Outcome

Teams can reliably determine whether their product triggers the CRA 24‑hour reporting clock, reducing uncertainty and ensuring timely compliance.

Workflow

• 1. Install cra‑watch via curl and make executable.
• 2. Run ./cra-watch scan to resolve dependencies and compare against OSV.dev and KEV.
• 3. Review output: if KEV matches, decide if the vulnerability is reachable in your product and trigger the 24‑h clock.
• 4. Schedule the scan in CI (e.g., GitHub Actions) with a cron trigger to catch new KEV entries.
• 5. Document the decision and evidence in an evidence log for compliance.
• 6. If a KEV match is confirmed, file the early warning, notification, and final report per CRA timelines.

Evidence

"If a vulnerability in a product you've placed on the EU market is being actively exploited, you owe an early warning to your coordinating national CSIRT and ENISA within 24 hours of becoming aware of it."

Source

"It reads your lockfiles, resolves them against OSV.dev, and intersects the result with the CISA Known Exploited Vulnerabilities catalogue — the closest thing to a public register of what's genuinely being exploited in the wild."

Source