Open a reporting case and follow the clock

Since 11 September 2026, an actively exploited vulnerability or a severe incident must be reported to ENISA in three steps. A reporting case in Provetry follows them for you (paid plans).

1. Under Reporting, click Open a reporting case, or open it from an exploited vulnerability of a product.
2. Choose actively exploited vulnerability or severe incident, give a short title and the identifier.
3. Enter when you became aware. The clock starts there: it is your statement, the moment you had reasonable certainty, not the first rumour.
4. Fill in your answers (what happened, how it is exploited, measures taken, what users can do…). They fill the drafts; a field left empty shows as missing in the draft. They are stored encrypted.
5. For each step (early warning within 24 hours, notification within 72 hours, final report), copy the draft into ENISA’s Single Reporting Platform, submit it there, then click Mark as submitted: the reminders stop.
6. When a fix or mitigation is available, enter its date: the final report is due 14 days later.

The case also drafts the notice to users that the CRA asks you to send. Drafts are in English, the language most authorities accept.