A vulnerability in the log: what CVE-2026-103624 means for evidence integrity

A vulnerability that touches evidence

CVE-2026-103624 has been published in the EU Vulnerability Database, a curated repository maintained by ENISA ^[1]. The entry does not yet carry a CVSS severity score, but its presence in the database means organisations must assess whether their systems are affected and, if so, how quickly they can remediate.

For many organisations, a vulnerability is an operational concern: patch it, test it, move on. When the vulnerability affects logging or evidence integrity, it becomes a compliance and trust question as well.

Under DORA, financial entities must have logging procedures that protect log systems and log information against tampering, deletion and unauthorised access ^[2]. Under the Cyber Resilience Act, manufacturers of products with digital elements must report actively exploited vulnerabilities and serious incidents, with an early warning within 24 hours and a full incident notification within 72 hours ^[3]. Under Sweden's Cybersecurity Act, essential and important entities must report significant incidents on a similar timeline ^[5].

A vulnerability that allows an attacker to alter logs, delete them or gain unauthorised access directly affects an organisation's ability to meet those obligations. Logs are what you show a supervisor, an auditor or a court when someone asks what happened. If the logs cannot be trusted, the evidence falls apart.

What the regulations require

DORA's technical standard on ICT risk management, which has applied since 17 January 2025, states that logging procedures must protect log systems and log information against tampering, deletion and unauthorised access, and must detect errors in the logging process ^[2].

The Cyber Resilience Act requires manufacturers to report vulnerabilities that are actively exploited, and serious incidents, through ENISA's central reporting platform ^[3]. The regulation applies from 11 September 2026 for reporting obligations, though the full security requirements take effect from 11 December 2027.

Sweden's Cybersecurity Act, which implements the NIS2 Directive and entered into force on 15 January 2026, requires essential and important entities to report significant incidents in three stages: an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month ^[5].

For AI systems, Article 12 of the AI Act requires high-risk systems to technically enable automatic logging of events throughout their lifetime, for traceability, post-market monitoring and user oversight ^[4]. The rule applies to Annex III systems from 2 December 2027 and to Annex I systems from 2 August 2028. A vulnerability that prevents a system from logging, or allows logs to be altered without detection, affects the ability to meet that requirement when it comes into force.

The evidence question in practice

Say a bank operating under DORA discovers that CVE-2026-103624 affects the logging component in one of its core systems. The vulnerability allows an attacker with certain privileges to delete log entries without leaving a trace.

The bank's ICT risk management framework requires logs to be protected against deletion. The vulnerability undermines that protection. Until it is remediated, the bank cannot confidently tell a supervisor or an auditor that its logs are intact.

Now say a manufacturer of connected medical devices discovers the same vulnerability in the logging module it uses across its product line. The Cyber Resilience Act requires the manufacturer to assess whether the vulnerability is being actively exploited, and if it poses a serious risk, to report it via ENISA's platform. The manufacturer must also issue remediation guidance to users, with a deadline that depends on the severity.

In both cases, the question is not only whether systems are secure, but whether the logs that document what happened can be relied upon. A vulnerability that affects log integrity affects the ability to produce credible evidence.

What this means for you

If your organisation is subject to DORA, the Cyber Resilience Act, the Cybersecurity Act or the AI Act, and you rely on logs to demonstrate compliance, resilience or decision-making, ask these questions:

• Does CVE-2026-103624 affect any of the systems or components we use for logging, incident monitoring or evidence collection?
• If it does, can an attacker with access alter or delete logs without leaving a detectable trace?
• What is our timeline for assessing the risk, applying a patch or implementing a workaround?
• Do we need to report this vulnerability under the Cyber Resilience Act or the Cybersecurity Act, and if so, have we met the deadlines?
• If we cannot immediately remediate, what compensating controls can we put in place to protect log integrity in the meantime?
• When a supervisor, auditor or court asks us to show what happened, can we demonstrate that our logs have not been altered since the events they record?

The last question is the one that matters most. Regulations set timelines and obligations, but the underlying question is always the same: can you prove what happened, with evidence someone else can check?

What to watch

The full security requirements under the Cyber Resilience Act, set out in Annex I, apply from 11 December 2027 ^[6]. Manufacturers of products with digital elements should assess now whether their logging and monitoring capabilities meet those requirements, and whether any known vulnerabilities, including CVE-2026-103624, prevent them from doing so.

For high-risk AI systems under Annex III, the logging requirement in Article 12 applies from 2 December 2027 ^[4]. Providers of such systems should verify that their logging mechanisms are technically capable of recording events automatically, and that vulnerabilities affecting those mechanisms are identified and remediated in time.

For financial entities under DORA, the obligation to protect logs against tampering, deletion and unauthorised access has applied since 17 January 2025 ^[2]. Any vulnerability that undermines that protection should be treated as a compliance risk and remediated accordingly.

The EU Vulnerability Database is updated as new CVEs are curated and severity scores are assigned. Organisations should monitor it alongside other sources, and treat vulnerabilities affecting logging and evidence integrity as a priority, not only for security but for trust.