EU Cyber Resilience Act

2026-W32 looking ahead — items already in motion: a NIS2 law in force in six days, a PAM appliance whose full exploitation detail is due in September, five products that will never be patched, and a federal ISMS deadline five months out

Items already in motion at the close of ISO week 2026-W32, each with a source and a date. None of these is a prediction.

Dated obligations.

• 15 August 2026 — the Netherlands' Cyberbeveiligingswet enters into force, together with the companion critical-entities resilience law, imposing registration, duty-of-care, incident-notification and board-accountability duties on more than 8,000 organisations across 18 sectors, with registration in NCSC-NL's national entity register mandatory from that date (Rijksoverheid, 2026-07-07). Relevant to anyone with Dutch entities, suppliers or public-sector counterparts, whose notification behaviour changes on that date.
• 11 September 2026 — the Cyber Resilience Act's reporting obligations begin, ahead of the regulation's principal obligations in December 2027. 13 September 2026 — ENISA's consultation on the draft EU Managed Security Services certification scheme closes, two days later; providers delivering services under the EU Cybersecurity Reserve would need that certification within two years of the scheme's entry into force, which makes it a procurement gate rather than a voluntary mark. Both were established in prior weekly coverage and neither date has moved.
• 2 December 2026 — two new prohibited AI practices apply under the AI Act as amended, and 2 December 2027 / 2 August 2028 are the new application dates for high-risk obligations under Annex III and Annex I respectively, following Regulation (EU) 2026/1744 (EUR-Lex, 2026-07-24). Any readiness plan written against 2 August 2026 for Annex III systems is now diarised to the wrong date.
• 1 January 2027 — Swiss federal administrative units must have built their ISMS. The Informationssicherheitsverordnung requires the administrative units under its Article 2(1)(c) to build their information-security management system within three years of the ordinance's entry into force, and the ordinance entered into force on 1 January 2024 (Fedlex, ISV SR 128.1). Roughly five months remain. The addressee is the federal administration itself; commentary that presents this as a general critical-infrastructure obligation is reading it more broadly than the text supports.

Disclosure and exploitation clocks.

• September 2026 — full technical details of the WALLIX Bastion authentication bypass are due. WALLIX states that the reporting researchers intend to publish the complete write-up of the CVSS 4.0 base 10.0 flaw that gives an unauthenticated caller full product-administrator control of the appliance — its credential vault and session recordings included — in September (WALLIX, 2026-07-20). Bastion 12.3.7 and 12.4.1 and later are patched, per the CERT-FR advisory that relayed the bulletin (CERT-FR, 2026-08-06). This is a dated window for remediating quietly, not a current threat.
• Cl0p's Windchill and FlexPLM listings have still not begun. Research re-checked this week found no leak-site listing for that campaign, leaving affected organisations in the interval between exfiltration and publication — the status a prior weekly recorded, unchanged.

Flaws with no fix coming. Five items from this week's coverage will not be resolved by waiting for a vendor, and each therefore converts into an architecture or lifecycle decision:

• Tobit TeamDavid — 22 CVEs bounded at "Rollout 524" with no fixed release named, against roughly 12,000 internet-facing instances, and researchers reporting that both they and the coordinating national cyber security centre were left without a vendor response (InfoGuard Labs, 2026-08-07).
• Flowise — three CVEs assigned days after the vendor announced it is winding down; self-hosted operators own the compensating controls.
• Zbtlink routers (ENDLESSDOORS) — a factory-shipped root backdoor on twenty models, where the discloser's remediation is device replacement.
• CPDLC over ATN-B1 — five flaws that are properties of the standard, with CISA recording the remediation category as none-available.
• Check Point's end-of-support management trains — R80 through R81.10 are listed as affected by this week's unauthenticated management-authentication bypass with no fix on offer.

In development, no date. NCSC UK confirms it is working with international partners on a reference architecture for forensic observability in network appliances, intended to give vendors something concrete to build to (NCSC UK, 2026-07-29). It is not published, and no publication date is stated. Separately, the Metabase SQL-injection zero-day exploited this week still has no CVE identifier assigned, so it will not reach any process that waits for one.

Builds on: 2026-08-09/wallix-bastion-rest-api-unauth-admin-cvss10 · 2026-08-09/teamdavid-tobit-22-cves-unauth-mailbox-takeover-dach · 2026-08-08/flowise-three-cves-vendor-sunset-no-fix-coming · 2026-08-06/endlessdoors-zbtlink-router-factory-shipped-root-backdoor · 2026-08-08/cpdlc-atn-b1-five-protocol-flaws-no-mitigation-available · 2026-08-05/check-point-cve-2026-18574-management-auth-bypass · 2026-08-09/metabase-unauth-sqli-zeroday-exploited-framework-tally

2026-W31 looking ahead — items already in motion: a committed firmware date of 12 August, WebSphere fix packs not due before 3Q2026, an extortion campaign between exfiltration and publication, three flaws with no fix at all, and the CRA reporting clock at six weeks

Items already in motion at the close of 2026-W31, each with a source and a date. None of these is a prediction.

A firmware release with a committed deadline — 12 August. CERT@VDE's advisory covering 20 vulnerabilities in Phoenix Contact CHARX SEC-3xxx EV charging controllers, five of them CVSS 9.8 with an unauthenticated network vector, published without the fix: "the updated firmware will be made available as soon as possible, but no later than August 12, 2026." (CERT@VDE, 2026-07-30). Until then the vendor's only offered control is closed-network operation behind a firewall — and one of the flaws makes the on-device firewall unavailable for a window during every shutdown. The date is checkable and worth checking.

Permanent WebSphere fix packs not expected before 3Q2026. IBM has no workaround for the CVSS 9.8 missing-authentication flaw in the WebSphere Application Server traditional administrative console, and targets the permanent Fix Packs 9.0.5.29 and 8.5.5.31 for 3Q2026, leaving the interim fix under APAR DT496500 as the only remediation now (IBM PSIRT, 2026-07-28); a companion bulletin the same day carries the deserialization flaw and APAR PH72166 (IBM PSIRT, 2026-07-28). Estates that defer interim fixes on principle are deferring past a quarter boundary.

An extortion campaign between exfiltration and publication. Cl0p-affiliated actors have been sending staff-wide emails naming PTC Windchill as the breach vector, but as of the last reported observation the second shoe had not dropped: "as of 22 July, Cl0p ransomware has not begun listing victims of this latest campaign on their dark web data leak site or has publicly claimed credit for this latest campaign." (Ransom-ISAC, 2026-07-22). Any organisation that ran an internet-exposed, unpatched Windchill or FlexPLM instance in June sits inside that gap, and the campaign's own precedent is that listings follow.

Three flaws with no fix, and one of them exploited. Langflow's pre-authentication eval injection is being exploited with no documented fixed version, and ZDI's only stated mitigation is to restrict interaction with the product (Zero Day Initiative, 2026-01-09). fastjson 1.x will not receive one: "FastJson 1.x is no longer actively maintained, and no patched 1.x version has been released for this vulnerability." (Imperva, 2026-07-24). And Siemens records the entire Desigo CC V7 family under remediation category none_available, with network segmentation as the only offered control (Siemens ProductCERT, 2026-07-14). These three leave the vulnerability queue by being made unreachable or not at all.

An embargo that has already broken. The Rails security team abandoned its plan to withhold the CVE-2026-66066 Active Storage exploitation details until 2026-08-28, publishing the attack write-up four weeks early along with a forensic-evidence guide and tooling to determine whether an application was vulnerable and whether it was exploited (Ruby on Rails security team, 2026-07-31). The window in which the chain was private is closed; what remains in motion is the population of unpatched applications, and the published forensic check is how an operator establishes which side of it they are on.

The CRA reporting clock, at six weeks. "Although the principal obligations will apply from December 11, 2027, reporting obligations take effect on September 11, 2026." (Hunton Andrews Kurth, 2026-07-29). From that date the regulation's reporting obligations bind manufacturers of products with digital elements — which for this constituency is a change in what EU-market suppliers owe their customers, arriving more than a year before the rest of the regulation applies. The notification window and article number are deliberately not stated here: no source fetched this run carries them.

Builds on: 2026-08-02/phoenix-contact-charx-sec-3xxx-unauth-root-no-firmware-yet · 2026-08-01/ibm-websphere-cve-2026-14512-14446-preauth-no-fix-pack · 2026-07-27/clop-windchill-flexplm-mass-extortion-wave-cve-2026-12569 · 2026-07-29/cve-2026-0769-langflow-preauth-eval-rce-exploited-not-in-kev · 2026-07-27/cve-2026-16723-fastjson-1x-spring-boot-fat-jar-rce-no-patch · 2026-07-29/cve-2025-15467-siemens-desigo-cc-cms-overflow-v7-unfixed · 2026-08-02/cve-2026-66066-rails-attack-chain-public-forensic-tooling

The European Commission published its first official Cyber Resilience Act application guidance six weeks before the regulation's reporting obligations begin — clarifying which products are in scope, including remote data processing and free and open-source software

The Cyber Resilience Act's first operational deadline has been on defenders' calendars for months without an authoritative account of who it applies to. The Commission published one on 2026-07-27, as Communication C(2026) 5252 with an annex, and the parts that resolve real ambiguity are the scope boundaries: the guidance covers "clarifying when certain products fall within the scope of the Cyber Resilience Act, including remote data processing solutions and free and open source software" (European Commission, 2026-07-27). Those two categories are exactly where suppliers have been arguing they fall outside the regulation — a hosted component with a device-side client, and an open-source dependency with no commercial vendor behind it. The document is built for practical application rather than legal argument, with "particular attention has been paid to microenterprises and SMEs, with 67 practical examples, a range of use cases, flowcharts and graphs" (European Commission, 2026-07-27). It also addresses what counts as a substantial modification — the change that restarts conformity obligations — and how support-period duration should be determined.

The timing is the point. Legal analysis of the guidance sets out the sequence plainly: "although the principal obligations will apply from December 11, 2027, reporting obligations take effect on September 11, 2026." (Hunton Andrews Kurth, 2026-07-29). So the first thing the CRA actually requires of manufacturers is incident and vulnerability reporting, and it starts in roughly six weeks, more than a year before the bulk of the regulation binds. Guidance clarifying scope arriving now is guidance about who has to stand up a reporting capability before mid-September.

For a Swiss federal SOC the CRA creates no direct obligation, and the honest framing of its relevance is indirect but real. It runs through the supplier tail: EU-market suppliers of connected products to Swiss and European public-sector and critical-infrastructure customers are the regulated parties, and the scope clarifications determine which of them are inside the reporting regime. Two consequences are worth tracking rather than acting on. First, a supplier newly understanding itself to be in scope — particularly one shipping a remote data processing solution it had assumed was a service rather than a product — will be standing up an incident-reporting process on a six-week timeline, which is a period in which disclosure behaviour tends to be inconsistent. Second, the substantial-modification clarification bears on when a supplier's own update and patch practice re-triggers conformity assessment, which is a plausible source of future friction between a customer wanting a fix quickly and a vendor facing a re-assessment to ship it.