CISA discontinues its weekly Vulnerability Bulletin as of 28 September in shift to risk-based prioritisation
Any organisation whose vulnerability intake depended on the bulletin now has a gap and should assign ownership for direct vendor feeds straight away. The policy shift also signals that severity scores alone are no longer an adequate basis for prioritisation. Programmes should weight exploitation evidence, such as the KEV catalogue, together with asset exposure and business criticality.
What Happened
CISA is discontinuing its weekly Vulnerability Bulletin at the end of FY26 (28 September 2026), as part of a broader move from severity-based vulnerability management to risk-based vulnerability prioritisation. The change affects security teams, critical infrastructure owners and operators, state, local, tribal and territorial partners, and other stakeholders that relied on the weekly CVSS-based summaries. CISA encourages organisations to consult vendor and provider advisories directly.
Why It Matters
Any organisation whose vulnerability intake depended on the bulletin now has a gap and should assign ownership for direct vendor feeds straight away. The policy shift also signals that severity scores alone are no longer an adequate basis for prioritisation. Programmes should weight exploitation evidence, such as the KEV catalogue, together with asset exposure and business criticality.
Sources
- CISA (opens in a new tab): Bulletins | CISA (2026-09-28)
More From This Briefing
- CISA adds two actively exploited critical Citrix NetScaler flaws to KEV; federal deadline 30 September
- Anthropic releases Claude Sonnet 5.5 at unchanged API prices, adding cyber safeguards to its mid-tier model
- New estimate puts US data centre and AI infrastructure investment at $10.3 trillion from 2025 to 2032
- Actively exploited SharePoint flaw CVE-2026-65660 passes CISA's 28 September federal patch deadline
This story is part of the Laurenceo Intelligence briefing for 29 September 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.