CyberNew CyberNew
Threat Intelligence & APT SecurityWeek 4 weeks ago

CISA Retires Weekly Vulnerability Bulletin in Risk-Based Pivot

CN
CyberNew Threat Research Desk
• Original Reporting: SecurityWeek
CyberNew Threat Intel Assessment
Assessed Severity: MEDIUM
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Threat Intelligence & APT

Analyst Takeaway

"The US Cybersecurity and Infrastructure Security Agency (CISA) announced on Wednesday that it’s retiring its weekly vulnerability bulletin. The vulnerability bulletin will be discontinued on September 28 as part of a shift to a risk-based approach in vulnerability management. The bulletin provides a summary of new vulnerabilities recorded each week. It includes information such as product name,..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)
CISA

The US Cybersecurity and Infrastructure Security Agency (CISA) announced on Wednesday that it’s retiring its weekly vulnerability bulletin.

The vulnerability bulletin will be discontinued on September 28 as part of a shift to a risk-based approach in vulnerability management. 

The bulletin provides a summary of new vulnerabilities recorded each week. It includes information such as product name, description of the flaw, the date of publication, severity, CVSS score, CVE identifier, and patch information (when available).

Each bulletin contains entries for thousands of vulnerabilities, sorted alphabetically by affected product name and severity, but it does not provide guidance on prioritizing the security holes. Without threat intelligence or context on active exploitation, the sheer volume of flaws can lead to alert fatigue for defenders.

CISA noted that the discontinuation of the bulletin “aligns with Binding Operational Directive (BOD) 26‑04, which directs federal agencies to prioritize vulnerabilities based on real‑world risk factors, including evidence of exploitation and exposure, rather than severity scores alone.”

BOD 26‑04, published in June, required federal agencies to review and update their vulnerability management policies and prioritize the remediation of flaws included in the KEV catalog.

Advertisement. Scroll to continue reading.

Written By Eduard Kovacs

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from SecurityWeek.

Primary Advisory →