CISA Retires Weekly Vulnerability Bulletin in Risk-Based Pivot
CISA will discontinue its weekly vulnerability bulletin on September 28, shifting defenders toward risk-based prioritization via the KEV catalog.
CISA announced it will retire its weekly vulnerability bulletin on September 28 as part of a shift to risk-based vulnerability management. The change aligns with Binding Operational Directive BOD 26-04, published in June, which directs federal agencies to prioritize flaws based on real-world risk factors such as exploitation evidence and to remediate KEV-listed vulnerabilities. CISA will continue providing risk-focused information through the KEV catalog, alerts, and advisories.
- Weekly bulletin ends September 28; it summarized thousands of CVEs without prioritization guidance.
- BOD 26-04 directs agencies to prioritize exploitation evidence and exposure over CVSS scores.
- KEV catalog, launched in 2021, has become defenders' primary prioritization reference.
- SOCs relying on the bulletin must adjust; CISA continues KEV, alerts, and advisories.
- Vendors
- CISA
- Products
- KEV catalog
- Organizations
- CISA
From the original article
2 min read at securityweek.com
The decision follows BOD 26-04, which directs federal organizations to prioritize vulnerabilities based on real-world risk. The post CISA Retires Weekly Vulnerability Bulletin in Risk-Based Pivot appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.