CISA decides weekly vulnerability bulletin isn't necessary anymore

The Cybersecurity and Infrastructure Security Agency (CISA) has announced that it will discontinue its weekly vulnerability bulletin at the end of September. This decision is part of a shift in how CISA prioritizes security updates, moving away from a severity-based approach to a more risk-based methodology. This change is outlined in a June Binding Operational Directive (BOD) that emphasizes prioritizing security updates based on real-world risk rather than treating all vulnerabilities equally.

The new approach takes into account factors such as evidence of exposure and exploitation, degree of control granted by exploitation, and whether exploitation can be automated. CISA's remediation table highlights these factors when determining the severity of a vulnerability. The decision to eliminate the weekly bulletin may be due to the sheer volume of new vulnerabilities being discovered, which are being addressed at an increasingly rapid pace with AI-assisted security research.

Additionally, the National Vulnerability Database continues to face a backlog of vulnerabilities, while the broader CVE ecosystem struggles to distinguish genuine vulnerabilities from AI-generated reports. Although CISA encourages security professionals to rely on its known exploited vulnerabilities catalog, cybersecurity alerts and advisories, and the CVE catalog, those currently subscribing to the bulletin will need to manually ensure their subscriptions are active in GovDelivery or Granicus accounts to avoid missing critical notices.