CISA's new KEV entries could start your 24 hours
CISA's KEV catalog only lists confirmed exploitation. A new entry naming a dependency you ship can start Article 14's 24-hour clock today.
The KEV catalog's exploitation bar
CISA's Known Exploited Vulnerabilities catalog lists only vulnerabilities with confirmed exploitation, not every disclosed CVE. Each entry means someone confirmed a specific product is being attacked, with a date attached. A new entry naming a dependency you ship is the kind of signal that changes what you know and when you know it.
Why that catalog matters under the CRA
Article 3, point 42 defines "actively exploited" as reliable evidence that someone used a vulnerability without the owner's authorization. A KEV entry is exactly that kind of evidence, dated and public. Article 14 has applied since 11 September 2026: once you know a product you shipped is actively exploited, you have 24 hours to send an early warning to your CSIRT and ENISA, and 72 hours for the full notification.
The clock starts at knowledge. It doesn't wait for a customer email, an audit, or a letter from an authority. A KEV entry naming a dependency you ship is one of the clearest ways that knowledge arrives.
A concrete case
Say you sell a reconciliation extension built on Adobe Commerce, under your own name, for a monthly fee. That makes you a manufacturer under article 3, points 13 and 22: you develop the product and place it on the market as part of a commercial activity. Your extension didn't cause the bug. But if your customers run the vulnerable Adobe Commerce version through your extension, and you know it, article 14 paragraph 8 also asks you to tell those customers without undue delay, with mitigation steps if you have them.
What's still ahead
No fine attaches to a missed 24-hour window yet. Article 64's fines start from 11 December 2027, alongside the rest of the regulation: SBOM, technical documentation, the declaration of conformity. Today's obligation is narrower and already live: know, then notify.
Whether any of this applies to you depends on one question: are you a manufacturer under the CRA? The scope test takes two minutes: https://crakit.eu/scope/
Not legal advice.
This is not legal advice.