CISA Retires Its Weekly Vulnerability Bulletin, Shifting to Risk-Based Advisory Model

The Bulletin Is Going Away, Not the Underlying Data

CISA’s weekly vulnerability bulletin has for years been a low-effort way for security teams worldwide to get a consolidated, regular digest of newly disclosed vulnerabilities. That changes at the end of September 2026. As reported by The Register on September 16, 2026, CISA confirmed the bulletin would stop going out after Monday, September 28, framing the move as part of the agency’s shift “from managing vulnerabilities based on severity to a modern, risk-based approach.”

That approach is detailed in a June 2026 Binding Operational Directive (BOD) that instructs covered US federal civilian agencies to prioritize security updates based on real-world risk rather than treating all vulnerabilities and systems equally. As CISA put it in its June announcement, the directive “evolves upon CISA’s known exploited vulnerabilities catalog and increases mission readiness across the federal government by efficiently prioritizing high-risk vulnerabilities for timely action, while deferring action against low-risk vulnerabilities”. The directive’s remediation table weighs factors including evidence of exposure and active exploitation, the degree of control an exploit grants an attacker, and whether exploitation can be automated — a materially different filter than the static CVSS severity score the bulletin traditionally organized around.

Why Now: A Vulnerability Firehose CISA No Longer Wants to Summarize Weekly

CISA did not fully explain why it chose to scrap the bulletin outright rather than simply adapt its format to the new risk-based standard, but The Register’s reporting points to a scaling problem behind the decision: the volume of newly disclosed vulnerabilities has grown sharply as AI-assisted security research accelerates discovery, even as the National Vulnerability Database continues to face a substantial backlog and the broader CVE ecosystem has to increasingly sift through bogus, AI-generated vulnerability reports to identify genuine ones. A static weekly digest built for a slower disclosure environment becomes both harder to compile and less useful as a snapshot once the underlying volume outpaces what a periodic bulletin can meaningfully summarize.

What Replaces the Bulletin

CISA is not asking security teams to abandon CVE-based tracking altogether. The agency’s announcement points organizations that need to stay current on vulnerability information toward three channels instead: its Known Exploited Vulnerabilities (KEV) catalog, its cybersecurity alerts and advisories, and the CVE catalog itself. Critically, none of these are automatically delivered to former bulletin subscribers — anyone who currently relies on the weekly bulletin needs to actively log into their GovDelivery or Granicus subscription account and confirm the KEV Catalog and Cybersecurity Advisories subscriptions are separately enabled, or they risk missing critical notices once the bulletin stops.

What This Means for Algerian Security Teams

Algeria’s government agencies, banks, telecom operators and larger enterprises are not covered by CISA’s directive, but many of them use CISA’s KEV catalog and advisories as an informal, free source of vulnerability intelligence precisely because Algeria’s own vulnerability-disclosure infrastructure is less mature. This change affects that workflow directly.

1. Re-verify your subscriptions now, not after September 28

Any Algerian security team, CERT, or IT department that currently references CISA’s weekly bulletin — whether through direct subscription or via a security vendor’s digest that repackages it — should confirm before the cutoff date what replaces it in their own workflow. Waiting until after the bulletin stops risks a gap in vulnerability awareness at exactly the moment attackers exploit newly disclosed flaws fastest.

2. Risk-based prioritization is the more durable lesson, independent of CISA’s specific tooling

The underlying shift CISA is making — from “patch everything above a severity threshold” to “patch what is actually being exploited, with the most attacker leverage, first” — is a sound prioritization model regardless of which agency’s catalog an Algerian organization tracks. Algeria’s CERT (if formally operating a national coordination function) and larger enterprise security teams should adopt the same real-world-exploitation-first logic in their own patch management, rather than treating every CVE as equally urgent.

3. This is a reminder Algeria cannot permanently outsource vulnerability intelligence to a foreign agency

CISA’s KEV catalog is free and genuinely useful, but it is built around US federal priorities and disclosure patterns, and CISA can change its format or discontinue services with a few weeks’ notice, as this bulletin retirement shows. Algeria’s own cybersecurity authority should treat building (or continuing to build) an independent, locally relevant vulnerability-tracking and advisory capability as a resilience priority, not a nice-to-have, precisely because dependence on any single foreign source carries exactly this kind of disruption risk.

Frequently Asked Questions

Sources & Further Reading

• CISA decides weekly vulnerability bulletin isn’t necessary anymore — The Register