CISA to End Weekly Vulnerability Bulletin on September 28

The U.S. Cybersecurity and Infrastructure Security Agency will discontinue its weekly vulnerability bulletin on September 28, 2026. The announcement was made on September 16. Organizations that regularly receive information from the agency will need to change their operations.

According to reporting by Brandon Vigliarolo of The Register, the reason for the discontinuation is the agency’s shift from severity-based management to a modern, risk-prioritized approach. The discontinuation date, September 28, falls on a Monday. Ending the bulletin at the end of September will affect responses not only at federal agencies but also at private companies.

In a binding operational directive in June, the agency signaled the policy shift. It applies to federal civilian agencies. It calls for prioritizing updates based on real-world risk rather than treating all vulnerabilities and assets equally.

Details of the Announcement Ending the CISA

Weekly Vulnerability Bulletin

The agency announced that it will end publication of the weekly bulletin on September 28. The reason is a shift from severity-based management to a risk-prioritized approach. Notably, it chose discontinuation rather than revising the format.

The weekly bulletin has traditionally served to convey new vulnerabilities in a list. Administrators and engineers were able to grasp the overall picture on a weekly basis. Losing this established channel means redesigning how information is collected.

The agency is not asking users to stop using vulnerability information itself. It also has not said that references to CVEs should be abandoned. It is urging a change in how information is obtained and how it is prioritized.

The announcement pointed to use of the Known Exploited Vulnerabilities catalog as an alternative. The catalog collects vulnerabilities confirmed to have been actively exploited. It is positioned at the core of improving operations at federal agencies.

This Directive evolves upon CISA’s known exploited vulnerabilities catalog and increases mission readiness across the federal government by efficiently prioritizing high-risk vulnerabilities for timely action, while deferring action against low-risk vulnerabilities

The above is the agency’s description of the June directive. It shows an aim to address high-risk vulnerabilities quickly. It also makes clear a policy of deferring action on low-risk vulnerabilities.

Shift to Risk-Based Prioritization and

Details of the Directive

The June directive is a binding document for federal civilian agencies. It calls for prioritizing updates by risk rather than applying them uniformly. The stated goal is to increase mission readiness.

Factors for decisions include exposure and evidence of exploitation. The degree of control gained through exploitation is also considered. Whether exploitation can be automated is also an evaluation criterion.

Previously, Common Vulnerability Scoring System scores were emphasized. The directive moves away from ranking based solely on static scores. The aim is to reflect the likelihood of actual harm.

The agency has not explained that it will align the weekly bulletin with the new criteria. It also has not detailed the causal relationship between the discontinuation and the new policy. The reason for choosing discontinuation over updating the format remains unclear.

This point is difficult for operators to understand. That is because a list format and risk-based prioritization could coexist. Interpretation of the agency’s intent will be a focus going forward.

Background:

Moving Away from CVSS and Growing Report Volume

The move away from relying solely on static scores predates this decision. Scores indicate severity but do not directly show the reality of exploitation. Whether systems are exposed and how easily attacks can be automated have grown in importance.

The growing number of reports is also seen as a factor. Research aided by artificial intelligence is increasing detection volume. The number of items requiring fixes is expanding, making it harder to fit them into a weekly list.

The National Vulnerability Database has a large backlog. The CVE system as a whole is also facing a growing vetting burden. There is a need to filter out inaccurate reports generated by AI.

In such an environment, it is difficult to maintain comprehensive lists. Filtering by exploitation history is more effective than a format that chases volume. The end of the weekly bulletin can be seen as reflecting that change.

Endpoint hygiene remains a challenge in day-to-day operations. Just as cleanup tools such as FluentCleaner, the new open-source alternative to CCleaner help, filtering information is becoming important. Organizations need to cut unnecessary information and focus on high-risk targets.

Impact on Vulnerability Response Practices

and Alternatives

The direct impact is that the weekly list will no longer arrive. Passive monitoring by email will no longer be possible. A shift to proactive information gathering will be necessary.

The central alternative is the Known Exploited Vulnerabilities catalog. Priority will be given to addressing vulnerabilities that have actually been exploited. It is highly valuable as a reference even outside federal agencies.

Checking CVEs and advisories for individual products remains essential. Notifications from vendors and industry groups need to be combined. Understanding one’s own assets and exposure is a prerequisite.

For low-risk vulnerabilities, deferring action may be an option. It should be noted that this is deferral, not abandonment. Management combining vulnerability risk with asset criticality is required.

Japanese companies are not unaffected. Organizations using U.S. products have relied on the agency’s information. They should secure alternative sources before September 28.

Editorial Opinion

On short-term impact: In the next three to six months, we expect gaps in information gathering at organizations that relied on the weekly bulletin. We assess that a shift to the Known Exploited Vulnerabilities catalog and vendor advisories will advance. Organizations slow to make the switch may see delays in response.

From a long-term perspective, we expect the shift from static scores to risk-based prioritization to take hold. We assess that decisions factoring in exposure and the potential for automated exploitation will become standard. To cope with growing report volumes, selective operations may spread.

Questions from the editorial team: We see debate over whether ending the weekly list is improved efficiency or a retreat from public disclosure. We assess that questions remain over whether deferring low-risk vulnerabilities will become permanent neglect. The question of what the optimal format for providing information is remains open.

References

• “CISA decides weekly vulnerability bulletin isn’t necessary anymore”, by Brandon Vigliarolo — The Register, 2026-09-16T20:33:48.000Z (ARR)
• Source URL: https://www.theregister.com/security/2026/09/16/cisa-decides-weekly-vulnerability-bulletin-isnt-necessary-anymore/5296968