INC-20261111-EF2C

Exploited authentication bypass in the gateway management interface · critical · aware 2026-11-11 18:13:57 UTC

CRA — severe incident

Regulation (EU) 2024/2847, Article 14
  • Early warningArticle 14(4)(a)
    Submitted
    filed 2026-11-12 12:13:57 UTC

    Within 24 hours of becoming aware, stating whether the incident is suspected of being caused by unlawful or malicious acts.

  • Incident notificationArticle 14(4)(b)
    Running falls at a weekend
    in 31h due 2026-11-14 18:13:57 UTC

    Within 72 hours of becoming aware of the incident. · Draft it

  • Final reportArticle 14(4)(c)
    Not started
    — starts on submitting the notification

    Within one month after the submission of the incident notification — counted from when you actually submitted it, not from the 72-hour deadline. · Draft it

Record a notification for CRA — severe incident
The real moment it went out. The one-month final-report clock runs from this.

NIS2 — significant incident

Directive (EU) 2022/2555, Article 23
  • Early warningArticle 23(4)(a)
    Submitted
    filed 2026-11-12 13:13:57 UTC

    Within 24 hours of becoming aware of the significant incident.

  • Incident notificationArticle 23(4)(b)
    Running falls at a weekend
    in 31h due 2026-11-14 18:13:57 UTC

    Within 72 hours of becoming aware, updating the early warning with an initial assessment. · Draft it

  • Intermediate reportArticle 23(4)(c)
    Not requested
    — no deadline until they ask

    Only upon the request of the CSIRT or competent authority. No deadline until they ask.

  • Final reportArticle 23(4)(d)
    Not started
    — starts on submitting the notification

    Not later than one month after the submission of the incident notification. · Draft it

  • Final report after handlingArticle 23(4)(e)
    Not started
    — starts on the handling being completed

    Where the incident is still ongoing at the one-month point, a progress report is due then and the final report within one month of the handling being completed. · Draft it

Record a notification for NIS2 — significant incident
The real moment it went out. The one-month final-report clock runs from this.

What was actually sent

2
Submitted (UTC)RegimeStageToRef
2026-11-12 12:13 CRA early CRA single reporting platformPortal CRA-2026-4471
2026-11-12 13:13 NIS2 early BSI (national CSIRT)Portal BSI-INC-88213

Evidence

0 files

Nothing attached. Screenshots of the portal acknowledgment, the sent notification, and the technical analysis live here.

PDF, PNG, JPEG or WebP, up to 10 MB. The file itself has to be one of those — the name is not enough.
×
Live demo — signed in as the admin, sample data resets hourly.
Own it — one payment →