A flaw is not always a flaw under active attack. The CRA term needs sound proof of a real act. A bad actor must have used the flaw in a system without the owner’s leave.

This limit matters when a public note, CVE, vendor alert, or scan comes in. Each may start a review. First check what it proves. Do not call it proof of active attack just because the label sounds urgent.

Test the evidence, not the label

Start with four clear questions:

  1. Is the flaw in the maker’s product?
  2. Does the proof show real use, not just that use is possible?
  3. Was the use harmful and without the owner’s leave?
  4. Is the proof sound enough for the saved result?

The answer may change as new facts come in. Keep the old check, add the new proof, and record the new choice time. This trail is better than a final label with no reason.

Build an evidence matrix

Give each sign of attack its own row. Record the source, first event, product, and version. State if the source saw real use and if that use had leave. Keep a vendor claim, public note, user report, system log, and research test apart until proof links them.

One row may show that an attack can work but not that it did. Another may show bad acts but not that the flaw is in the maker’s product. Record both gaps. Do not turn an urgent label into a legal result.

Test product containment

Trace the weak point to the part, build, setup, and released product. The weak code may be present but out of reach in that setup. If so, keep the path check and its guesses. If a part changed during the fix, keep product maps from before and after.

Use a separate field for proof that points the other way. Check a vendor denial, clean log span, or dispute over the source. Do not delete it. The reviewer can then explain why one source carried more weight.

Keep the second trigger open

A case that fails this flaw term may still be a severe event that harms product security. Run the two Article 14 tests on their own. Closing one says nothing about the other.

Save the result as met, not met, or still open. A “not met” result needs a fact that would reopen it. This may be a proven product match or sound proof of attack. An open result needs an owner and next check time.

This work step does not replace a legal choice. Send unclear proof to the legal and security reviewers who own the result.

Continue this workflow with the conflicting-signal review and the component-containment analysis.