Known and exploited vulnerabilities from official EUVD, CISA KEV and NVD sources — translated into clear operational priorities.
An unauthenticated attacker can exploit vulnerable PAN-OS GlobalProtect configurations to execute arbitrary commands with root privileges. CISA added the issue to its Known Exploited Vulnerabilities Catalog.
Open verified NVD record ↗From 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe product-security incidents through ENISA’s Single Reporting Platform.
What security and privacy teams should prepare before a harmonised digital form reaches national authorities.
Review the EDPB template ↗Walk through NIS2, GDPR and CRA decisions without losing the evidence trail or the clock.
Read the reporting timeline →Choose a scenario to see how technical facts become a regulatory reporting decision.
Start the NIS2 assessment immediately. Preserve detection time, affected services, impact, indicators and the decision trail for the 24-hour early warning.
A concise operational view of the rules behind cyber-incident reporting.
Align evidence fields across security, privacy and legal teams before the form becomes operational.
Manufacturers and open-source stewards need ownership, escalation paths and report-ready product evidence.
Reporting thresholds, competent authorities and local submission paths must remain current in every Member State.
Keep the DORA decision path distinct while reusing reliable evidence, classification and approval records.
A first-time sign-in from an unexpected country reaches a managed service environment. Is it a security event, a significant incident or a reportable personal data breach?
Know which body is competent, which channel to use and what evidence should be ready before the deadline starts to bite.
Practical structures for repeatable, auditable reporting.
Detection time, affected services, indicators, impact, ownership and open questions.
Use in ComplyIT ↗TEMPLATE · NIS2The minimum reliable case record your team should be able to approve under pressure.
Use in ComplyIT ↗DECISION MAP · MULTI-RULEKeep parallel obligations visible without duplicating evidence or losing accountability.
Use in ComplyIT ↗Malicious code in XZ Utils 5.6.0 and 5.6.1 can modify liblzma during the build process. Identify affected Linux packages and replace them with trusted versions.
Official source ↗Affected PHP-CGI installations on Windows can interpret crafted characters as command-line options, enabling disclosure or arbitrary code execution.
Official source ↗A signal-handler race condition in vulnerable OpenSSH servers may allow unauthenticated remote code execution. Upgrade to a fixed release and restart sshd.
Official source ↗An unauthenticated attacker can access the MOVEit Transfer database and alter or delete data. CISA confirms exploitation in the wild.
Official source ↗Attacker-controlled JNDI lookups in vulnerable Log4j versions can lead to remote code execution. Locate embedded copies and update the library itself.
Official source ↗A command-injection flaw in Ivanti Connect Secure and Policy Secure can execute arbitrary commands on affected appliances and is listed in CISA KEV.
Official source ↗