Definition

Corrective or mitigating measure

A security update or other action that removes or reduces an exploited vulnerability; its availability starts the 14-day final-report timer.

A security update, configuration change, workaround or other action that eliminates or mitigates a vulnerability. Under Article 14 the availability of a corrective or mitigating measure is the trigger for the vulnerability final report; until such a measure exists no final-report timer runs. Manufacturers should record precisely when a fix became available to users — a released version and its publication time — because the 14 days count from that moment.

Reference: Art. 14(2)(c) · Regulation (EU) 2024/2847 on EUR-Lex

Updated 2026-09-12 · Paraphrase for orientation, not legal advice.