Art. 14(2)(a) · 24 hours
Early warning
Deadline metSIMULATED
Submitted
Recorded 22 Oct 2026, 14:28 UTC
- Deadline
- 23 Oct 2026, 13:06 UTC
- Clock started
- 22 Oct 2026, 13:06 UTC
- Report
- Submitted manually (drill, nothing sent)
CRA reporting status
Regulation (EU) 2024/2847, Article 14. Reporting obligations for actively exploited vulnerabilities apply from 11 September 2026.
Products tracked1Ledgerline, from this repository
SBOM componentsNot availableDetection report not available
Known vulnerabilitiesNot availableDetection report not available
Actively exploited, live0Listed in CISA KEV and confirmed by a person
Art. 14(2)(b) · 72 hours
Vulnerability notification
Deadline metSIMULATED
Submitted
Recorded 22 Oct 2026, 14:28 UTC
- Deadline
- 25 Oct 2026, 13:06 UTC
- Clock started
- 22 Oct 2026, 13:06 UTC
- Report
- Submitted manually (drill, nothing sent)
Art. 14(2)(c) · 14 days after fix
Final report
Deadline metSIMULATED
Submitted
Recorded 22 Oct 2026, 14:28 UTC
- Deadline
- 05 Nov 2026, 13:58 UTC
- Clock started
- 22 Oct 2026, 13:58 UTC
- Report
- Submitted manually (drill, nothing sent)
Cases
| Mode | Case | Product | Vulnerability | Exploitation | Current step | Next deadline |
|---|---|---|---|---|---|---|
| EXERCISE | A14-20261022-1 | ledgerline 1.0.0 | CVE-2022-23540 | Simulated | Closed | None |