CISA Ends Weekly Vulnerability Bulletin as Risk-Based Rules Take Over

The US Cybersecurity and Infrastructure Security Agency (CISA) will discontinue its weekly vulnerability bulletin on 28 September, ending a service that summarised newly recorded vulnerabilities, including affected products, descriptions, publication dates, severity ratings, CVSS scores, CVE identifiers and available patch information. The bulletins listed thousands of vulnerabilities alphabetically by product and severity, but did not indicate which flaws should be addressed first.

CISA said the change supports Binding Operational Directive (BOD) 26-04, published in June, which requires US federal agencies to prioritise vulnerabilities using real-world risk factors such as evidence of exploitation and exposure, rather than severity scores alone. The directive also requires agencies to prioritise remediation of vulnerabilities in CISA’s Known Exploited Vulnerabilities (KEV) catalogue. CISA introduced the catalogue in 2021 to focus on vulnerabilities with documented exploitation in the wild.

The agency said it will continue providing risk-focused information through the KEV catalogue, alerts and advisories. Security operations centres that used the weekly bulletin to track newly disclosed flaws may therefore need to adjust their processes. The change reflects a wider move away from relying solely on CVSS, which measures theoretical technical severity, towards assessments incorporating active exploitation, threat actor interest and exposure.