EU Cyber Resilience Act

2026-W33 looking ahead — items already in motion: a CRA reporting clock at four weeks, standards approval that will not beat it, an exploited flaw with no patch in existence, seven further flaws with no fix coming, and twelve thousand Polish clinics who each owe a notification

Items already in motion at the close of ISO week 2026-W33. Each carries a source and a date; none is a prediction.

• The Cyber Resilience Act's reporting obligations begin on 11 September 2026 — four weeks out, and the first hard operational clock in the regulation. ETSI's approval procedure for the 17 draft harmonised standards "will run until mid-September to mid-November 2026, depending on the vertical" (ETSI, 2026-08-13), so no presumption-of-conformity route will be available in the covered product categories before the reporting duty starts. The two are independent obligations and the second does not wait for the first.

• GeoServer's unauthenticated SQL injection has no CVE and no vendor patch, and is being exploited. watchTowr recorded hundreds of exploitation attempts within hours of the 12 August disclosure (SecurityWeek, 2026-08-14). Until OSGeo ships a fix, taking query endpoints off the public internet is the whole remediation — and GeoServer sits under public-sector geoportals and INSPIRE spatial-data services across Europe.

• Seven further flaws tracked this week have no fix in existence, beyond the GeoServer injection above. ShieldBreak, the published bypass of Microsoft's July fix for the Defender privilege-escalation flaw, is listed as tested on Windows Server 2025 and Windows 11 25H2 with no patch available and no vendor comment at publication (Cyber Kendra, 2026-08-12). Three FreeBSD CAM Target Layer pre-authentication kernel primitives behind TCP/999 were answered with a manpage warning rather than a code fix, and ship enabled by product design on TrueNAS Enterprise high-availability clusters (Calif, 2026-08-06). Three of the five NatJack NAT primitives carry no identifier and no vendor fix, and the Linux change for the one that does is recorded by the researcher as a partial mitigation.

• Around 12,000 Polish medical facilities each owe their own patients a notification over the MyDr breach, because the data-protection authority has confirmed the duty rests with the healthcare controllers rather than the platform (Gazeta Prawna, 2026-08-13); the facility count is reported at around 12,000 (Notes from Poland, 2026-08-13). MyDr itself has stated it cannot yet say what was taken, so the notifications and the scoping are proceeding in the wrong order.

• The Dutch Cyberbeveiligingswet registration obligation is live now, not pending. NCSC-NL states the duty applies from the Act's entry into force on 15 August 2026, with registration through the national entity register gated by eHerkenning at level EH2+ or SSOnRijk (NCSC-NL, 2026-08-15); no transition window is described.

• The Cl0p PTC Windchill extortion wave is between claim and confirmation. A leak-site tracker recorded 44 named victim listings on 12 August including a Swiss and a Dutch organisation, while BleepingComputer counts 43 named through exploitation of the Windchill flaw; two named organisations have since responded — Philips describing a contained single-server event and Shell saying it is investigating — neither attributing its incident to that flaw, and no other named victim has commented (BleepingComputer, 2026-08-14). Organisations running exposed Windchill or FlexPLM instances are in the window where a scoped exposure check and a webshell hunt cost less than waiting for the listing.

• Swiss federal administrative units have until 1 January 2027 to have built their own information security management system under the federal ordinance this pipeline tracks — four and a half months out, carried forward as a standing date rather than a new development.

Builds on: 2026-08-15/geoserver-jsonarraycontains-unauth-sqli-zeroday-exploited · 2026-08-12/shieldbreak-defender-rogueplanet-patch-bypass-no-fix · 2026-08-10/freebsd-ctl-ha-three-preauth-kernel-rce-primitives-port-999 · 2026-08-10/natjack-nat-trust-assumption-attack-class-two-cves · 2026-08-15/mydr-poland-19-million-records-government-confirmed · 2026-08-15/clop-windchill-philips-shell-first-victim-confirmations

UPDATE — the Cyber Resilience Act's conformity route entered formal approval this week: ETSI put 17 draft product-category standards out for Public Enquiry, and the procedure runs past the regulation's first reporting deadline

UPDATE · originally covered The European Commission published its first official Cyber Resilience Act application guidance six weeks before the regulation's reporting obligations begin — clarifying which products are in scope, including remote data processing and free and open-source software (2026-08-02)

a prior weekly recorded the European Commission publishing its first official Cyber Resilience Act application guidance — the interpretive half of the problem, answering which products are in scope and what counts as a substantial modification. This week supplies a delta on the other half, the technical route to demonstrating compliance, and it comes with a timetable worth noting.

On 13 August ETSI announced "the availability of the 17 vertical final draft standards developed in the framework of the EU Cyber Resilience Act (CRA) and currently under Public Enquiry", submitted this summer to 41 member organisations across Europe including the national standardisation bodies of the European Economic Area. The purpose is stated plainly: these standards "aim to become Harmonised Standards, giving manufacturers a recognised way to demonstrate compliance with the legislation, the so-called 'presumption of conformity'". The chair of the responsible technical committee frames the gap they fill in a sentence that also explains why their absence matters — "The Cyber Resilience Act lays down what manufacturers, and the market need to achieve, but it does not tell you how" (ETSI, 2026-08-13), reported independently the following day (Help Net Security, 2026-08-14).

The EN 304 series categories are not consumer-peripheral, which is what makes this a procurement item rather than a compliance-desk one. Alongside browsers, password managers, antivirus software, smart-home virtual assistants, smart-home security products, connected toys and wearables, the drafts cover VPNs, network management systems, SIEM, boot managers, PKI certificate-issuance software, network interfaces, operating systems, routers, modems and switches, virtualization and container platforms, and firewalls — most of a public-sector security stack (ETSI TC CYBER-EUSR open document store, 2026-08-13). The press release itself names only the consumer-facing subset; the full vertical list comes from the draft filenames in ETSI's own open document store, which the release links. The timing is the constraint: ETSI states "The approval procedure will run until mid-September to mid-November 2026, depending on the vertical", and that window opens at or after the CRA's first hard operational date, the reporting obligations beginning on 11 September 2026 that this pipeline already tracks. So for the coming months there is no harmonised standard a supplier can point to, and conformity has to be demonstrated against the regulation's essential requirements directly, or through third-party conformity assessment for the critical categories.

2026-W32 looking ahead — items already in motion: a NIS2 law in force in six days, a PAM appliance whose full exploitation detail is due in September, five products that will never be patched, and a federal ISMS deadline five months out

Items already in motion at the close of ISO week 2026-W32, each with a source and a date. None of these is a prediction.

Dated obligations.

• 15 August 2026 — the Netherlands' Cyberbeveiligingswet enters into force, together with the companion critical-entities resilience law, imposing registration, duty-of-care, incident-notification and board-accountability duties on more than 8,000 organisations across 18 sectors, with registration in NCSC-NL's national entity register mandatory from that date (Rijksoverheid, 2026-07-07). Relevant to anyone with Dutch entities, suppliers or public-sector counterparts, whose notification behaviour changes on that date.
• 11 September 2026 — the Cyber Resilience Act's reporting obligations begin, ahead of the regulation's principal obligations in December 2027. 13 September 2026 — ENISA's consultation on the draft EU Managed Security Services certification scheme closes, two days later; providers delivering services under the EU Cybersecurity Reserve would need that certification within two years of the scheme's entry into force, which makes it a procurement gate rather than a voluntary mark. Both were established in prior weekly coverage and neither date has moved.
• 2 December 2026 — two new prohibited AI practices apply under the AI Act as amended, and 2 December 2027 / 2 August 2028 are the new application dates for high-risk obligations under Annex III and Annex I respectively, following Regulation (EU) 2026/1744 (EUR-Lex, 2026-07-24). Any readiness plan written against 2 August 2026 for Annex III systems is now diarised to the wrong date.
• 1 January 2027 — Swiss federal administrative units must have built their ISMS. The Informationssicherheitsverordnung requires the administrative units under its Article 2(1)(c) to build their information-security management system within three years of the ordinance's entry into force, and the ordinance entered into force on 1 January 2024 (Fedlex, ISV SR 128.1). Roughly five months remain. The addressee is the federal administration itself; commentary that presents this as a general critical-infrastructure obligation is reading it more broadly than the text supports.

Disclosure and exploitation clocks.

• September 2026 — full technical details of the WALLIX Bastion authentication bypass are due. WALLIX states that the reporting researchers intend to publish the complete write-up of the CVSS 4.0 base 10.0 flaw that gives an unauthenticated caller full product-administrator control of the appliance — its credential vault and session recordings included — in September (WALLIX, 2026-07-20). Bastion 12.3.7 and 12.4.1 and later are patched, per the CERT-FR advisory that relayed the bulletin (CERT-FR, 2026-08-06). This is a dated window for remediating quietly, not a current threat.
• Cl0p's Windchill and FlexPLM listings have still not begun. Research re-checked this week found no leak-site listing for that campaign, leaving affected organisations in the interval between exfiltration and publication — the status a prior weekly recorded, unchanged.

Flaws with no fix coming. Five items from this week's coverage will not be resolved by waiting for a vendor, and each therefore converts into an architecture or lifecycle decision:

• Tobit TeamDavid — 22 CVEs bounded at "Rollout 524" with no fixed release named, against roughly 12,000 internet-facing instances, and researchers reporting that both they and the coordinating national cyber security centre were left without a vendor response (InfoGuard Labs, 2026-08-07).
• Flowise — three CVEs assigned days after the vendor announced it is winding down; self-hosted operators own the compensating controls.
• Zbtlink routers (ENDLESSDOORS) — a factory-shipped root backdoor on twenty models, where the discloser's remediation is device replacement.
• CPDLC over ATN-B1 — five flaws that are properties of the standard, with CISA recording the remediation category as none-available.
• Check Point's end-of-support management trains — R80 through R81.10 are listed as affected by this week's unauthenticated management-authentication bypass with no fix on offer.

In development, no date. NCSC UK confirms it is working with international partners on a reference architecture for forensic observability in network appliances, intended to give vendors something concrete to build to (NCSC UK, 2026-07-29). It is not published, and no publication date is stated. Separately, the Metabase SQL-injection zero-day exploited this week still has no CVE identifier assigned, so it will not reach any process that waits for one.

Builds on: 2026-08-09/wallix-bastion-rest-api-unauth-admin-cvss10 · 2026-08-09/teamdavid-tobit-22-cves-unauth-mailbox-takeover-dach · 2026-08-08/flowise-three-cves-vendor-sunset-no-fix-coming · 2026-08-06/endlessdoors-zbtlink-router-factory-shipped-root-backdoor · 2026-08-08/cpdlc-atn-b1-five-protocol-flaws-no-mitigation-available · 2026-08-05/check-point-cve-2026-18574-management-auth-bypass · 2026-08-09/metabase-unauth-sqli-zeroday-exploited-framework-tally