The US Cybersecurity and Infrastructure Security Agency (CISA) is ending its weekly vulnerability bulletin as federal cybersecurity policy moves toward prioritizing vulnerabilities according to real-world risk rather than technical severity alone.
CISA announced that the bulletin will be discontinued on September 28, 2026. The change is part of a broader shift toward risk-based vulnerability management under Binding Operational Directive (BOD) 26-04.
What Was Included in the Weekly Bulletin?
CISA’s weekly bulletin provided a consolidated overview of newly recorded vulnerabilities. Entries typically included the affected product, vulnerability description, publication date, severity rating, CVE identifier, CVSS score and available patch information.
Because each edition could contain thousands of vulnerabilities, the information was primarily organized by product and severity. However, the bulletin did not necessarily indicate which vulnerabilities posed the greatest immediate threat to an organization.
Security teams could therefore face challenges when attempting to determine which vulnerabilities should receive urgent attention, particularly when dealing with large numbers of newly disclosed flaws.
CISA Moves Toward Risk-Based Vulnerability Management
CISA said the decision to discontinue the bulletin is consistent with BOD 26-04, which instructs federal agencies to prioritize vulnerabilities using real-world risk indicators.
Factors such as evidence of active exploitation and whether vulnerable systems are exposed are given greater importance than severity scores alone.
The directive, issued in June, also requires federal agencies to review and update their vulnerability management policies and prioritize remediation of vulnerabilities listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog.
KEV Catalog Becomes a Key Resource
CISA’s KEV catalog has become an important source for organizations seeking to identify vulnerabilities that attackers are actively exploiting.
Unlike a general vulnerability list, the KEV catalog focuses on vulnerabilities for which exploitation has been documented in real-world attacks. This allows security teams to concentrate resources on flaws with demonstrated exploitation activity.
The broader cybersecurity industry has also increasingly moved away from using CVSS scores as the sole basis for patching decisions. While CVSS helps measure the technical severity of a vulnerability, risk-based approaches also consider factors such as exploitation activity, attacker interest and an organization’s exposure.
What the Change Means for Security Teams
Organizations that previously used CISA’s weekly bulletin as a source of newly disclosed vulnerability information may need to adjust their monitoring and vulnerability-management processes.
Security operations teams will need to combine multiple sources of vulnerability intelligence and pay closer attention to exploitation evidence, asset exposure and the potential impact on their specific environments.
The end of the bulletin does not mean CISA is stopping vulnerability-related alerts. The agency said it will continue publishing risk-focused information through the KEV catalog, alerts and security advisories.
A Broader Shift in Cybersecurity Priorities
The move reflects a growing emphasis on actionable vulnerability intelligence rather than simply tracking the number of newly disclosed security flaws.
For federal agencies and other organizations, the approach places greater importance on understanding which vulnerabilities represent an immediate operational threat and allocating remediation resources accordingly.
As vulnerability volumes continue to grow, risk-based prioritization is increasingly being used to help security teams focus limited resources on threats that could have the greatest real-world consequences.
