CISA is Sunsetting the Weekly Vulnerability Bulletin
Source Reddit Cybersecurity
Discussion
CISA will discontinue its Weekly Vulnerability Bulletin at the end of fiscal year 2026 (September 28, 2026) to transition from severity-based vulnerability management to risk-based vulnerability prioritization. Vulnerability information will continue to be accessible via CVE.org, the Known Exploited Vulnerability (KEV) Catalog, CISA Cybersecurity Alerts and Advisories, and vendor security alerts. This change reflects evolving vulnerability management strategies in response to the increasing volume of CVEs driven by AI-assisted research.
r/cybersecurity (opens in a new tab)u/Sad_Dentist_72880 points0 comments
"CISA will discontinue the weekly Vulnerability Bulletin at the end of FY26 (September 28, 2026) as part of a broader shift from severity‑based vulnerability management to risk‑based vulnerability prioritization. Newly recorded vulnerabilities remain available on CVE.org, and users should rely on the Known Exploited Vulnerability (KEV) Catalog, CISA Cybersecurity Alerts and Advisories, and vendor security alerts for actionable, risk‑based updates."
I can't help but feel that we're at the end of an era. I do appreciate the shifting of resources to risk-based vulnerability discovery and eradication, especially with AI-assisted vulnerability research increasing the number of CVEs by such a large amount. RIP to the weekly bulletin though, I'll miss it.
Also discussed in r/cybersecurity