CISA decides weekly vulnerability bulletin isn't necessary anymore
CISA will discontinue its weekly vulnerability bulletin on September 28, pushing users toward KEV, alerts, and CVE data under risk-based prioritization.
CISA announced its weekly vulnerability bulletin will stop on Monday, September 28, as part of a shift from static CVSS severity scores to a modern, risk-based approach detailed in a June Binding Operational Directive. The directive prioritizes federal remediation based on exposure, exploitation evidence, control granted by exploitation, and whether exploitation can be automated. CISA directs bulletin subscribers to rely instead on its Known Exploited Vulnerabilities catalog, cybersecurity alerts and advisories, and the CVE catalog, requiring users to enable those subscriptions in GovDelivery or Granicus to avoid missing critical notices.
- The June BOD defers action on low-risk vulnerabilities while prioritizing high-risk ones for federal civilian agencies
- Growing vulnerability volume, partly from AI-assisted research and CVE backlogs, may have made the weekly format untenable
- CISA did not explain why it scrapped the bulletin rather than adapting it to the new risk standards
- Organizations
- CISAGovDeliveryGranicus
From the original article
2 min read at theregister.comAgency's shift from static CVSS scores to risk-based prioritization sends the old format packing September 28
By Brandon Vigliarolo · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.