CISA Weekly Vulnerability Bulletin Ends September 28: What to Use Instead
The U.S. Cybersecurity and Infrastructure Security Agency will discontinue its weekly Vulnerability Bulletin on September 28, 2026, ending a feed that summarizes newly recorded vulnerabilities by product, severity, CVSS score, CVE identifier and available patch information.
CISA says the change is part of a shift toward risk-based vulnerability prioritization. The agency directs users toward CVE.org, the Known Exploited Vulnerabilities (KEV) Catalog, CISA Cybersecurity Alerts and Advisories, and vendor security advisories as continuing sources after the weekly bulletin ends.
For security teams that use the bulletin as a weekly patch inbox, the practical change is a workflow migration. New-vulnerability discovery still needs broad CVE and vendor coverage, while remediation priority should incorporate exploitation evidence, exposure and operational impact instead of relying on CVSS severity alone.
What changes on September 28
| Item | After September 28, 2026 |
|---|---|
| CISA weekly Vulnerability Bulletin | Discontinued |
| CISA KEV Catalog | Continues |
| CISA Cybersecurity Alerts and Advisories | Continues |
| CVE.org | Continues as a broad CVE source |
| Vendor security advisories | Continue and remain important for affected/fixed versions |
| BOD 26-04 | Continues to govern covered federal agencies |
CISA's bulletin has been useful as a broad weekly digest because it collects large numbers of recently published vulnerabilities into one place. Its retirement changes that aggregation layer; it does not end the underlying CVE ecosystem or CISA's exploitation-focused vulnerability work.
Independent reporting from SecurityWeek corroborates the September 28 retirement date and CISA's rationale. The publication notes that weekly bulletins can contain thousands of vulnerabilities while providing limited prioritization context, a mismatch for teams trying to identify the flaws that create the greatest immediate risk.
A practical replacement workflow
A useful post-bulletin workflow separates discovery from priority.
1. Use CVE.org and vendor advisories for broad discovery
CVE.org remains a broad source for vulnerability identifiers and records. Vendor advisories remain essential because they commonly provide the information operators need to act: affected products, version ranges, fixed releases, configuration conditions, workarounds and patch links.
For infrastructure you actually operate, subscribe directly to security notices from the relevant operating-system, hypervisor, network, cloud, application and hardware vendors. This keeps product-specific remediation data close to the source.
2. Put KEV near the top of the remediation queue
CISA's Known Exploited Vulnerabilities Catalog tracks vulnerabilities for which there is evidence of exploitation in the wild. A KEV match therefore carries a different operational signal from a newly assigned CVE with a high theoretical severity score but no known exploitation.
For a small security team, checking the software inventory against new KEV entries is a compact way to identify vulnerabilities that deserve rapid triage. Internet exposure, privilege level, data sensitivity, compensating controls and business criticality still affect the final remediation order.
3. Keep CISA alerts and advisories in the monitoring stack
CISA says its Cybersecurity Alerts and Advisories remain part of the replacement information set. These publications can add campaign, exploitation or mitigation context that a generic CVE record may not contain.
The result is a layered feed: CVE and vendor sources provide coverage, while KEV and CISA advisories provide stronger signals for prioritization.
4. Automate against structured sources where possible
Teams that currently parse the weekly bulletin should inventory every script, dashboard and ticketing rule that depends on its format before September 28. Replace the retired input with supported structured sources and vendor feeds appropriate to the environment.
For KEV-driven automation, preserve the source fields needed for triage, then enrich matches with internal asset data. A useful queue can include the affected asset, internet exposure, business owner, patch or mitigation status, exploitation evidence and remediation deadline.
Automation should also tolerate feed changes and failed lookups. Keep the original advisory or vendor record linked from generated tickets so analysts can verify version and mitigation details before making production changes.
Where BOD 26-04 fits
CISA links the bulletin retirement to Binding Operational Directive 26-04, its risk-based vulnerability-management direction for covered federal civilian executive branch agencies. The policy emphasizes real-world risk factors, including exploitation and exposure, instead of sorting remediation work primarily by severity scores.
That federal directive is useful context for the broader prioritization shift. Private organizations can adopt the same risk signals without treating the directive itself as a private-sector compliance requirement.
The distinction also matters for vulnerability operations: CVSS describes technical severity; KEV adds evidence that attackers are exploiting a vulnerability. Neither signal alone represents an organization's complete risk. An exposed vulnerable service on a critical asset can warrant a different response from the same software isolated behind compensating controls.
Migration checklist for small teams and homelabs
Before September 28, identify any process that consumes the weekly CISA bulletin, including email rules, RSS readers, scripts, vulnerability dashboards and manually maintained patch lists.
Keep a broad discovery source such as CVE.org, then subscribe to the security advisories for products you actually run. Add the CISA KEV Catalog as a high-priority exploitation signal and retain CISA alerts for campaign and mitigation context.
For each new issue, record the affected version, fixed version, exploitation status, exposure and asset importance. Those fields are more useful for patch ordering than a list sorted only by CVSS.
Finally, test the replacement workflow before the bulletin disappears. A short overlap period gives teams time to find products or feeds that their new monitoring stack misses.
Bottom line
The September 28 retirement removes CISA's weekly vulnerability aggregation bulletin, while the agency's exploitation-focused and advisory sources continue. Teams that depended on the bulletin should move broad discovery to CVE.org and vendor advisories, use KEV as a strong exploitation signal, and combine those sources with their own asset exposure and business context.
The change is a useful deadline for replacing a severity-first weekly patch list with a workflow that separates vulnerability coverage from remediation priority.