Draft · INC-20261111-EF2C · Kestrel Systems GmbH (Demo)

Built from the incident record, under headings that follow what the provision asks for. Yours to check, complete and send through the authority's own form or portal; Cyresora files nothing.

3 items to complete — the record does not hold your initial assessment of the incident; what users can do; your sensitivity assessment. Each is marked [to complete: …] in the text.

Incident notification — INC-20261111-EF2C — Exploited authentication bypass in the gateway management interface

DRAFT: Incident notification under CRA — severe incident
Regulation (EU) 2024/2847, Article 14, Article 14(4)(b).
Prepared by Cyresora from incident INC-20261111-EF2C. Yours to check and edit before you send it; Cyresora files nothing.

To: CRA single reporting platform

1. Reporting organization
Kestrel Systems GmbH (Demo)
Contact: security@kestrel.example

2. Incident
Exploited authentication bypass in the gateway management interface
Our reference: INC-20261111-EF2C
Became aware: 2026-11-11 18:37:02 UTC (2026-11-11 19:37 CET)
Severity (our assessment): critical

3. Nature of the incident (Article 14(4)(b))
A customer reported unauthorized configuration changes. Log review confirms an unauthenticated request path reaching the management API on firmware 4.2.0 and 4.2.1, and confirms it has been used against at least two customer deployments.

4. Initial assessment (Article 14(4)(b))
Severity: critical
[to complete: your initial assessment of the incident]

5. Corrective or mitigating measures taken (Article 14(4)(b))
Firmware 4.2.2 published to the update channel.

6. Corrective or mitigating measures users can take (Article 14(4)(b))
[to complete: what users can do]

7. How sensitive you consider this information (Article 14(4)(b))
[to complete: your sensitivity assessment]

8. Earlier submissions under this regime
Early warning: submitted 2026-11-12 12:37:02 UTC, their reference CRA-2026-4471

When you have sent it

Record it here with what you actually sent (edit the text above to match). That record stops this stage's clock and starts the next one from the moment you enter.

Submitted at (Europe/Berlin)

Channel

Their reference

Draft: Incident notification

Incident notification — INC-20261111-EF2C — Exploited authentication bypass in the gateway management interface

When you have sent it