The recent security vulnerabilities known as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619) highlight the importance of a coordinated approach to vulnerability management. According to media reports, information about the vulnerabilities had become known before the security updates were released. Attackers could exploit the vulnerabilities to obtain sensitive data or execute malicious code remotely. Security updates are now available, and affected operators should install them promptly.

When must manufacturers report a security vulnerability, and does a 24-hour deadline apply? How should remediation and public disclosure of a vulnerability be coordinated? Who decides whether a vulnerability receives a Common Vulnerabilities and Exposures (CVE) identifier?

A discovered vulnerability does not, in itself, constitute a significant cybersecurity incident. Austria’s new Network and Information Systems Security Act 2026 (Netz- und Informationssystemsicherheitsgesetz 2026, or NISG 2026), which entered into force on October 1, 2026, distinguishes between coordinated vulnerability disclosure and the obligation to report a significant cybersecurity incident.

Notify the Manufacturer First, Then Coordinate Any Disclosure

Anyone who discovers a vulnerability should first use the manufacturer’s designated contact channel. If no suitable contact is available or communication stalls, a coordinating body can help facilitate the process. Section 11 of the NISG 2026 provides for the national Computer Security Incident Response Team (CSIRT) for this purpose. It can bring the relevant parties together and coordinate when and how the vulnerability will be disclosed. Reports can also be submitted anonymously.

Austria’s guidelines on Coordinated Vulnerability Disclosure (CVD) refer individuals who wish to report security vulnerabilities to CERT.at. Such a report is not a statutory incident notification and does not automatically lead to public disclosure.

If a vulnerability is to be disclosed publicly, timing is critical. The parties involved should coordinate disclosure with the development and distribution of a security update and adhere to the agreed schedule. Premature, uncoordinated disclosure of vulnerability information should be avoided. Unauthorized premature disclosure may give rise to claims for damages if it is unlawful, culpable, and causes harm.

Assigning a CVE ID Is a Separate, Generally Voluntary Step

CVE stands for “Common Vulnerabilities and Exposures.” A CVE ID uniquely identifies a vulnerability internationally. It is assigned by an authorized CVE Numbering Authority (CNA), which is often the manufacturer. Reporting a vulnerability does not automatically result in a CVE ID. Manufacturer approval is not always required.

An assigned CVE ID does not necessarily mean that a public entry has been published. By the time the entry is published, at least one other public source containing information about the vulnerability must be available at the same time. A CVE identifier, the publication of technical information, and the availability of a security update must therefore be treated as separate steps.

An incorrect entry can be challenged by submitting supporting evidence to the responsible numbering authority and, where appropriate, escalating the matter to a higher-level authority. If an objection appears justified, the entry is marked “disputed” while the matter is under review; it is not automatically deleted.

When Is Reporting Mandatory?

In addition to the NISG 2026, the Cyber Resilience Act (CRA) establishes separate reporting obligations for manufacturers of covered products with digital elements. Since September 11, 2026, these obligations have applied to actively exploited vulnerabilities and severe security incidents affecting product security. Reporting deadlines also apply. Reports must be submitted through the CRA Single Reporting Platform operated by the European Union Agency for Cybersecurity (ENISA). A newly discovered vulnerability is not automatically reportable merely because it has been identified.

By contrast, the 24- and 72-hour deadlines under the NISG 2026 apply to essential and important entities that must report a significant cybersecurity incident. An early warning must be submitted without undue delay and no later than 24 hours after becoming aware of the significant incident. A subsequent notification must generally be submitted without undue delay and no later than 72 hours after awareness of the incident. These deadlines are not triggered merely by the discovery of a new vulnerability or the assignment of a CVE ID.

Accordingly, discovering a vulnerability may already be relevant to coordinated disclosure under Section 11 of the NISG 2026. The incident reporting obligation under Section 34, however, requires an essential or important entity to become aware of a significant cybersecurity incident.

The reporting platform available through Austria’s Business Service Portal (Unternehmensserviceportal, or USP) can be used not only for mandatory incident notifications but also for voluntary reports under Section 37 of the NISG 2026. This is distinct from the generally voluntary CVE program. The program itself does not impose a statutory reporting obligation on manufacturers. However, participating numbering authorities must comply with the CVE program rules.

ENISA’s Role

The European Union Agency for Cybersecurity (ENISA) operates the European Vulnerability Database (EUVD), the EU’s vulnerability database. ENISA is also authorized to assign CVE IDs as a CVE Numbering Authority (CNA). Since November 20, 2025, ENISA has served as the CNA Root, the overarching coordinating authority for European organizations. In this role, it trains and manages subordinate CNAs, such as companies and CERTs.

The EUVD publishes information about vulnerabilities that have already been disclosed. Anyone seeking to report a newly discovered vulnerability should instead contact the manufacturer or a CVD coordination body. The CRA Single Reporting Platform and the USP reporting platform for mandatory and voluntary incident notifications under the NISG 2026 serve different purposes.

The Legal Classification Is What Matters

Confidential vulnerability reports, mandatory notifications under the NISG 2026 or the CRA, and the assignment of a CVE ID are subject to different requirements and serve different purposes. To determine whether a statutory reporting obligation applies, it is necessary to assess separately the relevant recipient, the triggering event, the competent authority, and the applicable deadline. Public disclosure is also a separate decision and does not automatically follow from submitting a report.

Furthermore, reporting a vulnerability anonymously does not, by itself, entitle the reporter to whistleblower protection. Whether such protection applies depends on whether the requirements of Austria’s Whistleblower Protection Act (HinweisgeberInnenschutzgesetz, or HSchG) are met.