CISA said in a notice on 16 September 2026 that on 28 September it would discontinue the weekly Vulnerability Bulletin as part of its shift from severity-based vulnerability management to a risk-based approach.

CISA said the change aligns with Binding Operational Directive (BOD) 26-04, which directs federal agencies to prioritise vulnerabilities based on real-world risk factors, including evidence of exploitation and exposure, rather than severity scores alone. CISA will continue to provide risk-focused vulnerability information through the Known Exploited Vulnerabilities (KEV) catalog, CISA cybersecurity alerts and advisories, and CVE, and encourages organisations to consult vendor and provider advisories directly.

Practical takeaway for AU SOCs that mirrored the bulletin: shift intake to KEV plus vendor PSIRTs and ASD-ACSC alerts. (source: CISA bulletin notice (GovDelivery))

Correction (25 Oct 2026): CISA's own notice of 16 September 2026 said it would discontinue the weekly Vulnerability Bulletin on 28 September 2026, so when SecurityWeek reported on 17 September the change had been announced but had not yet taken effect.

The notice names the KEV catalog, CISA cybersecurity alerts and advisories, and CVE as the continuing sources. The earlier note that no CISA page could be found has been removed. (source: CISA bulletin notice (GovDelivery))

Correction (31 Oct 2026): replaced SecurityWeek, which this desk cannot read, with CISA's own notice as the card's source and moved the card date from 17 to 16 September 2026, the notice's date. (source: CISA bulletin notice (GovDelivery))