What a plant stack is actually made of

The EU Cyber Resilience Act's reporting obligation starts 11 September 2026. It does not ask whether you are secure. It asks whether you can determine, within 24 hours, that a product you placed on the market contains a vulnerability somebody is actively exploiting.

That is an inventory question, so I measured the inventory.

The rig#

$ syft -q docker:inductiveautomation/ignition:8.3.8 -o json
$ grype -q docker:inductiveautomation/ignition:8.3.8 -o json

No agents, no registry account, no commercial scanner. Both tools are run as containers against images already on the host.

What is in there#

Ignition's 429 break down as 288 Java archives, 127 Debian packages, 9 binaries, 4 Go modules and one Python package — which is worth knowing on its own, because "a Java application" turns out to mean 288 separately-versioned things.

Note that matches exceed distinct CVEs everywhere: the same vulnerability is frequently found in several components of the same image.

The intersection that matters#

The CRA clock is triggered by active exploitation, not by a CVE existing. The closest public proxy is CISA's Known Exploited Vulnerabilities catalogue.

342 distinct CVEs. 1,685 KEV entries. Intersection: zero.

EPSS agrees. Exactly one CVE in the stack scores above 0.5 predicted probability of exploitation:

epss=0.733  pct=0.994  CVE-2011-3389  libgnutls30t64  (n3uron)
epss=0.070  pct=0.938  CVE-2017-17740 libldap2        (n3uron)
epss=0.053  pct=0.920  CVE-2015-3276  libldap2        (n3uron)

CVE-2011-3389 is BEAST — a TLS 1.0 CBC weakness from 2011, mitigated in practice by everything that has since moved to TLS 1.2+.

An honest caveat on the zero. This is one stack on one day. KEV grows weekly, and a CVE moving onto it is precisely the event the 24-hour clock exists for. The finding is not "this stack is safe" — it is that the reportable set today is empty, and that the check to establish this is cheap and repeatable.

Age distribution, or: this is not a museum#

The oldest is from 2005, the newest from this year. The industrial-software-is- ancient story does not survive contact with the dates: 90% of what a scanner flags here was assigned in the last two years.

This is a measurement of advisory activity, not of rot. A component with an active security team generates CVEs; an abandoned one generates silence. Reading the count as a danger score gets the sign wrong.

The duplication problem#

This is the finding that would actually cost you the 24 hours.

63 CVE-carrying components appear in more than one of the seven products. 50 of those 63 appear at more than one version.

When an advisory names openssl 3.5.6, the answer to "do we ship that?" is neither yes nor no. It is yes in one product, no in another, and the difference is a base-image choice made by a vendor you do not control.

That is why the inventory has to be a stored artifact rather than a question you answer by thinking. Under time pressure, from memory, nobody gets this right.

Cost of the census#

Against a 24-hour reporting obligation, the technical work is four and a half minutes and produces a file. Everything else about CRA compliance is organisational.

One failure worth recording#

The first EMQX scan produced a zero-byte result and a non-obvious error:

ERROR failed to catalog: an error occurred attempting to resolve
'emqx/emqx:latest': docker: unable to provide image from tarball:
file blobs/sha256/37416ecf…4c not found in tar

The locally cached image was missing a layer blob. A re-pull fixed it. Worth noting because a scanner that silently produces nothing for one product of seven is exactly how an inventory ends up 14% short without anybody noticing — the failure mode is an empty file, not an error in a report.

Verdict#

The obligation is answerable and the tooling is free. The number to watch is not the CVE count, which measures how carefully your suppliers are looking; it is the intersection with what is actually being exploited, which today is empty and next month may not be.

Do the boring thing: generate the inventory, date it, store it, and reconcile the fifty components that exist at more than one version before an advisory forces you to do it in a hurry.

The argument for a general audience is in nobody knows what software is inside your plant.