A manufacturer becomes aware of an actively exploited vulnerability at 09:00 on Monday. What is due, and when?

Why this is the answer

The clock runs from becoming aware: an early warning without undue delay and in any event within 24 hours, then a vulnerability notification with general information and an initial assessment within 72 hours. Waiting to have the full picture is not permitted, the sequence is not reversed, and informing users does not replace the report to the authorities.