CISA is Sunsetting the Weekly Vulnerability Bulletin

Your weekly summary of new vulnerabilities will stop arriving by mail in September 2026.

The Cybersecurity and Infrastructure Security Agency (CISA) will discontinue its weekly Vulnerability Bulletin by the end of Fiscal Year 2026, which concludes on September 28, 2026. This decision is part of a strategic shift from a focus on vulnerability severity to a risk-based approach for prioritizing cyber threats. CISA directs users to alternative resources for vulnerability information, including CVE.org for newly recorded vulnerabilities, the Known Exploited Vulnerability (KEV) Catalog, CISA Cybersecurity Alerts and Advisories, and vendor-specific security alerts. These resources are intended to provide actionable, risk-based updates for cybersecurity professionals and organizations. Interested parties are encouraged to subscribe to CISA's update channels for continued notifications.

This move signals a maturation in how government agencies approach cybersecurity information dissemination, moving towards a more intelligence-driven and actionable model. By sunsetting the general vulnerability bulletin, CISA is pushing organizations to adopt a more proactive and tailored cybersecurity strategy, emphasizing the exploitation of vulnerabilities rather than their mere existence. This aligns with industry trends towards threat intelligence platforms and risk-based vulnerability management, which are critical for efficient resource allocation in security operations.

Organizations that relied heavily on the weekly bulletin for a baseline understanding of emerging threats will need to adjust their information gathering processes. This may involve increased reliance on CISA's KEV catalog, vendor notifications, and potentially commercial threat intelligence feeds to maintain a comprehensive view of exploitable weaknesses. The shift necessitates a more sophisticated internal risk assessment framework to effectively prioritize patching and mitigation efforts.