CISA weekly vulnerability bulletin set to end September 28

Plans to end the weekly bulletin

According to the report, CISA announced that it would end the weekly bulletin as part of a move from prioritizing vulnerabilities by static CVSS severity scores to a risk-based approach. The reported approach weighs factors including evidence of exposure or exploitation, the control gained through exploitation, and whether exploitation can be automated.

CISA's weekly vulnerability bulletin had been a recurring update intended to help users track newly disclosed vulnerabilities.

The report says CISA will discontinue the weekly bulletin on September 28 and steer users to its Known Exploited Vulnerabilities Catalog, cybersecurity alerts and advisories, and the CVE Catalog instead.

Subscribers directed to KEV and advisory channels

The reported change would alter how subscribers receive CISA vulnerability information, emphasizing the Known Exploited Vulnerabilities Catalog and advisory channels rather than a single weekly bulletin.