Draft · INC-20261108-3B15 · Kestrel Systems GmbH (Demo)

Built from the incident record, under headings that follow what the provision asks for. Yours to check, complete and send through the authority's own form or portal; Cyresora files nothing.

3 items to complete — the record does not hold the measures you have taken; what users can do; your sensitivity assessment. Each is marked [to complete: …] in the text.

Vulnerability notification — INC-20261108-3B15 — Actively exploited deserialization flaw in libsignalproc as bundled

DRAFT: Vulnerability notification under CRA — actively exploited vulnerability
Regulation (EU) 2024/2847, Article 14, Article 14(2)(b).
Prepared by Cyresora from incident INC-20261108-3B15. Yours to check and edit before you send it; Cyresora files nothing.

To: CRA single reporting platform

1. Reporting organization
Kestrel Systems GmbH (Demo)
Contact: security@kestrel.example

2. Incident
Actively exploited deserialization flaw in libsignalproc as bundled
Our reference: INC-20261108-3B15
Became aware: 2026-11-08 10:37:02 UTC (2026-11-08 11:37 CET)
Severity (our assessment): high

3. General information about the product (Article 14(2)(b))
Kestrel Gateway, version 4.2.1

4. General nature of the exploit and of the vulnerability (Article 14(2)(b))
CVE-2026-30112 Deserialization flaw in bundled libsignalproc (severity high)

5. Corrective or mitigating measures taken (Article 14(2)(b))
[to complete: the measures you have taken]

6. Corrective or mitigating measures users can take (Article 14(2)(b))
[to complete: what users can do]

7. How sensitive you consider this information (Article 14(2)(b))
[to complete: your sensitivity assessment]

8. Earlier submissions under this regime
Early warning: submitted 2026-11-09 18:37:02 UTC, their reference CRA-2026-4402

When you have sent it

Record it here with what you actually sent (edit the text above to match). That record stops this stage's clock and starts the next one from the moment you enter.

Submitted at (Europe/Berlin)

Channel

Their reference

Draft: Vulnerability notification

Vulnerability notification — INC-20261108-3B15 — Actively exploited deserialization flaw in libsignalproc as bundled

When you have sent it