NewsPublished 17 Sep 2026

CISA Retires Weekly Vulnerability Bulletin in Risk-Based Pivot

Source SecurityWeek

Description

The US Cybersecurity and Infrastructure Security Agency (CISA) has retired its weekly vulnerability bulletin as part of a strategic shift to risk-based vulnerability management. The bulletin, which summarized thousands of new vulnerabilities weekly without prioritization guidance, will be discontinued on September 28, 2026. This change aligns with Binding Operational Directive (BOD) 26-04, which directs federal agencies to prioritize vulnerabilities based on real-world risk factors such as evidence of exploitation and exposure rather than severity scores alone. CISA emphasizes the use of its Known Exploited Vulnerabilities (KEV) catalog, which focuses on vulnerabilities with documented in-the-wild exploitation, providing more actionable prioritization for defenders. CISA will continue to provide risk-focused vulnerability information through the KEV catalog, alerts, and advisories. This shift reflects a broader industry move away from relying solely on CVSS scores toward more context-driven vulnerability management.

Impact

The retirement of the weekly vulnerability bulletin removes a broad but non-prioritized source of vulnerability information, potentially requiring security teams to adjust their processes. However, the shift to a risk-based approach focusing on vulnerabilities with known exploitation aims to improve prioritization and reduce alert fatigue. Federal agencies and other organizations relying on the bulletin must now use the KEV catalog and other risk-focused advisories to guide remediation efforts. This change may enhance the efficiency of vulnerability management but requires adaptation in how vulnerability data is consumed and acted upon.

Defensive guidance

No direct mitigation actions are required for this change itself. Organizations should transition from relying on the weekly vulnerability bulletin to using CISA’s Known Exploited Vulnerabilities (KEV) catalog and associated risk-based advisories for vulnerability prioritization and remediation. Security operations centers should update their processes to incorporate real-world risk factors such as evidence of exploitation and exposure when managing vulnerabilities, in alignment with BOD 26-04. CISA will continue to provide updated risk-focused vulnerability information through the KEV catalog and alerts.

Summary

CISA has discontinued its weekly vulnerability bulletin, which provided a broad summary of new vulnerabilities without prioritization, in favor of a risk-based approach mandated by BOD 26-04. The directive requires federal agencies to prioritize remediation based on real-world risk factors including active exploitation and exposure, rather than relying solely on CVSS severity scores. The KEV catalog, introduced in 2021, now serves as the primary reference for actionable vulnerability prioritization by listing only those vulnerabilities with known exploitation in the wild. This transition aims to reduce alert fatigue and improve the effectiveness of vulnerability management by focusing on threats with demonstrated impact. CISA will maintain risk-focused communications through the KEV catalog and targeted advisories, supporting federal agencies and security operations centers in adapting to this new approach.

References

securityweek.com/cisa-retires-weekly-vulnerability-bulletin-in-risk-based-pivot/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 17 Sep 2026, 14:32 UTC

References

Community reviews