CISA has discontinued its weekly vulnerability bulletin, which provided a broad summary of new vulnerabilities without prioritization, in favor of a risk-based approach mandated by BOD 26-04. The directive requires federal agencies to prioritize remediation based on real-world risk factors including active exploitation and exposure, rather than relying solely on CVSS severity scores. The KEV catalog, introduced in 2021, now serves as the primary reference for actionable vulnerability prioritization by listing only those vulnerabilities with known exploitation in the wild. This transition aims to reduce alert fatigue and improve the effectiveness of vulnerability management by focusing on threats with demonstrated impact. CISA will maintain risk-focused communications through the KEV catalog and targeted advisories, supporting federal agencies and security operations centers in adapting to this new approach.

The retirement of the weekly vulnerability bulletin removes a broad but non-prioritized source of vulnerability information, potentially requiring security teams to adjust their processes. However, the shift to a risk-based approach focusing on vulnerabilities with known exploitation aims to improve prioritization and reduce alert fatigue. Federal agencies and other organizations relying on the bulletin must now use the KEV catalog and other risk-focused advisories to guide remediation efforts. This change may enhance the efficiency of vulnerability management but requires adaptation in how vulnerability data is consumed and acted upon.

No direct mitigation actions are required for this change itself. Organizations should transition from relying on the weekly vulnerability bulletin to using CISA’s Known Exploited Vulnerabilities (KEV) catalog and associated risk-based advisories for vulnerability prioritization and remediation. Security operations centers should update their processes to incorporate real-world risk factors such as evidence of exploitation and exposure when managing vulnerabilities, in alignment with BOD 26-04. CISA will continue to provide updated risk-focused vulnerability information through the KEV catalog and alerts.