CISA Ends Weekly Vulnerability Bulletin

For years, a recurring fixture on many security teams' calendars was CISA's weekly roundup of known vulnerabilities. That fixture is going away. The US Cybersecurity Infrastructure and Security Agency says it will discontinue the bulletin from September 28, a change it ties to a newly introduced directive that reshapes how federal agencies are told to prioritize patching.

The move lands in the middle of a broader conversation about how vulnerability information reaches the people who need it, and who is responsible for acting on it once it arrives.

The bulletin's final date

According to the agency, the weekly bulletin of known vulnerabilities will end on September 28. That is the specific date given, and no replacement publication schedule for the same style of roundup has been described.

The bulletin had served as a recurring summary of vulnerabilities. Its discontinuation means organizations that relied on that particular channel will need to look to other CISA outputs, or to vendor communications, for the same kind of information.

The directive behind the decision

CISA attributes the change to the recently introduced Binding Operational Directive (BOD 26-04). That directive compels US agencies to prioritize patching vulnerabilities according to real-world risk factors.

Under the new approach, those factors include evidence of vulnerabilities being identified in the wild. That replaces the previous criterion of severity scores as the organizing principle for prioritization.

As the source reporting notes, it is not clear why the agency cannot continue to issue weekly bulletins while complying with the demands of BOD 26-04.

What CISA will keep publishing

Although it is no longer issuing weekly bulletins, CISA says it will continue to issue other information through several existing channels. Those include its Known Exploited Vulnerabilities (KEV) catalog, its Cybersecurity Alerts and Advisories, and its Common Vulnerabilities and Exposures catalog.

Each of these serves a different function, and the agency has not indicated any change to how they operate. Organizations that previously leaned on the weekly bulletin have these three destinations still available to them, alongside the vendors' own disclosures.

Vendors and researchers in the loop

The agency is also encouraging CISOs to follow vendors' and providers' own security bulletins and updates. The stated purpose is to strengthen their defences.

Earlier this year, CISA urged these vendors to work more closely with security researchers to improve defences against cyberattacks. Together, the two messages point toward vendor-side and research-side channels as part of the flow of vulnerability information that security leaders are expected to track.

AI threats on the agenda

What could be a more pressing issue for CISA, per the source reporting, is the proliferation of AI-generated threats. Earlier this month, the agency issued a warning about bad actors threatening AI-developed assets and using them to launch new attacks.

That advisory is separate from the bulletin decision, but it sits in the same period of activity for the agency. It concerns adversaries targeting AI-developed assets and leveraging them to launch new attacks, according to the agency's warning.

The unanswered question

The agency has given a reason for ending the bulletin, but a gap remains in the public explanation. It is not clear why the agency cannot continue to issue weekly bulletins while complying with the demands of BOD 26-04.

That is the point on which the two developments — a new prioritization directive and the end of a recurring publication — do not fully line up in the information provided so far. The directive changes how agencies are told to rank patching work; it does not, on its face, describe a publication schedule.

A changed information diet

For security leaders, the practical effect is a shift in where the recurring vulnerability information comes from. The weekly bulletin was one consolidated source. The channels CISA says it will keep using — KEV, Cybersecurity Alerts and Advisories, and the CVE catalog — are distinct, and the agency is pointing CISOs toward vendors' and providers' own bulletins and updates as well.

That means following more sources rather than fewer, at least in terms of the number of places a team needs to monitor.

Why it matters

The end of the weekly bulletin could matter most for organizations that treated it as a dependable, single place to check. Teams without dedicated threat-intelligence staff may find the transition harder than larger security operations that already track multiple feeds. The agency's own instruction — that CISOs follow vendors' and providers' security bulletins and updates — puts more of the routine monitoring burden on the organizations themselves.

The unresolved question of why the bulletin could not coexist with BOD 26-04 also leaves room for further clarification from CISA. Until then, the September 28 date is the concrete marker: after that point, the weekly summary is gone, and the KEV, alerts and advisories, and CVE channels remain.