CISA Retires Weekly Vulnerability Bulletin in Risk-Based Pivot
CISA retires its weekly vulnerability bulletin, shifting to a risk-based approach.
CISA is discontinuing its weekly vulnerability bulletin on September 28th, moving towards a risk-based vulnerability management strategy. This change aligns with Binding Operational Directive (BOD) 26-04, which mandates federal agencies prioritize vulnerabilities based on real-world exploitation and exposure, rather than solely on severity scores. The agency will continue to provide risk-focused information through its Known Exploited Vulnerabilities (KEV) catalog, alerts, and advisories.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Known Exploited Vulnerabilities catalog?
Get an email when a new story names Known Exploited Vulnerabilities catalog, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonCISA's retirement of its weekly vulnerability bulletin signals a critical evolution in how organizations should approach vulnerability management — moving away from static, severity-score-driven prioritization toward dynamic, exploitation-focused risk assessment. Relying solely on CVSS scores has long been a known gap, as high-severity vulnerabilities that are never exploited in the wild may consume resources better spent on lower-scored but actively weaponized flaws. The new strategy, anchored in BOD 26-04 and the KEV catalog, reflects real-world threat intelligence as the primary driver for remediation urgency. Organizations that have not yet adopted a risk-based vulnerability management program are now behind both federal guidance and industry best practice. This shift matters because misallocated patching efforts leave genuinely dangerous vulnerabilities unaddressed while teams chase theoretical risks.