CISA to End Weekly Vulnerability Bulletin in Shift to Risk-Based Prioritization

Summary

CISA will discontinue its weekly vulnerability bulletin on September 28, shifting toward risk-based prioritization. It will continue sharing vulnerability information through its KEV catalog, alerts, and advisories.

Key points

• CISA’s weekly bulletin, which summarized newly recorded vulnerabilities and available patch information, will end September 28.
• The bulletin listed thousands of vulnerabilities but did not guide defenders on prioritization, potentially contributing to alert fatigue.
• CISA says the change aligns with BOD 26-04, which directs federal agencies to prioritize vulnerabilities using real-world risk factors, including exploitation evidence and exposure.
• BOD 26-04 requires federal agencies to review and update their vulnerability management policies and prioritize flaws in CISA’s KEV catalog.
• CISA will continue providing risk-focused vulnerability information through the KEV catalog, alerts, and advisories.
• Security operations centers that relied on the weekly bulletin may need to adjust how they track new vulnerabilities.