CISA Ends Its Weekly Vulnerability Bulletin Sept. 28, Points Teams to the KEV Catalog

The Cybersecurity and Infrastructure Security Agency is ending its weekly vulnerability bulletin. The last edition goes out Monday, Sept. 28, and CISA calls the move part of a shift from severity-based vulnerability management to “a modern, risk-based approach,” The Register reported.

Why the bulletin is going away

The bulletin summarized new vulnerabilities each week, listing product name, description, publication date, severity, CVSS score, CVE identifier and patch information when available. Each edition covered thousands of flaws sorted by product and severity but offered no guidance on what to fix first, SecurityWeek noted.

CISA said dropping it “aligns with Binding Operational Directive (BOD) 26‑04, which directs federal agencies to prioritize vulnerabilities based on real‑world risk factors, including evidence of exploitation and exposure, rather than severity scores alone.” The June directive told federal civilian agencies to update their vulnerability management policies and prioritize flaws in the Known Exploited Vulnerabilities (KEV) catalog. Its remediation table weighs evidence of exposure and exploitation, how much control exploitation grants and whether exploitation can be automated.

CISA didn’t say why it scrapped the bulletin instead of adapting it. The Register suggested one possibility: the weekly list keeps getting longer as AI-assisted research turns up more vulnerabilities, while the National Vulnerability Database still faces a large backlog.

What security teams should do

CISA says teams should rely on the KEV catalog, its alerts and advisories, and the CVE catalog itself. Anyone who depends on the bulletin should log into their GovDelivery/Granicus account and make sure the KEV Catalog and Cybersecurity Advisories subscriptions are turned on, or they risk missing critical notices.

SOCs that built scrapers, tickets or weekly reviews around the bulletin will need to rework those pipelines. Since its 2021 launch, the KEV catalog has largely replaced generic summaries as defenders’ main reference because it only lists bugs with documented in-the-wild exploitation. It also means organizations must do their own exposure assessment for severe flaws that haven’t been exploited yet.