CISA to End Weekly Vulnerability Bulletins Amid Risk Shift

The US Cybersecurity and Infrastructure Security Agency (CISA) will discontinue its weekly vulnerability bulletins from 28 September 2026. The agency said the change supports a broader shift from prioritising vulnerabilities by severity alone to assessing their real-world risk.

Newly recorded vulnerabilities will remain available through CVE.org, while CISA recommends organisations use its Known Exploited Vulnerability (KEV) Catalog, cybersecurity alerts and advisories, and vendor security alerts for actionable updates.

The decision follows a sharp rise in vulnerability disclosures, which has contributed to growing remediation backlogs. CISA’s analysis of vulnerability data from 2024 and 2025 found that the number of vulnerabilities actually exploited by attackers increased only marginally despite the larger overall volume. The agency interpreted this as evidence that attackers concentrate on a relatively small subset of flaws.

Risk-based prioritisation should therefore consider factors including confirmed KEV status, exploit automation, technical impact and whether affected assets are exposed.

Security practitioners quoted in the report broadly supported moving beyond CVSS scores, but warned that ending the bulletins could make it harder for smaller or already stretched teams to identify emerging threats. Kevin Surace of TokenCore said KEV remains essential, while noting that vulnerabilities can present serious risk before exploitation is confirmed.

CISA’s change does not indicate that other vulnerability information will disappear; it shifts responsibility towards defenders to combine the remaining CISA resources with vendor information and knowledge of the systems they operate.