[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5KGUa6e68slH7duTBcIQzvKhPdytQpuYRCFas4p1Aqc":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":48},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"3f115340-86e2-4bc5-a456-144b42db3ad3","CISA Retires Weekly Vulnerability Bulletin in Risk-Based Pivot","cisa-retires-weekly-vulnerability-bulletin-in-risk-based-pivot-15484f","The decision follows BOD 26-04, which directs federal organizations to prioritize vulnerabilities based on real-world risk. The post CISA Retires Weekly Vulnerability Bulletin in Risk-Based Pivot appeared first on SecurityWeek.","CISA is discontinuing its weekly vulnerability bulletin on September 28th, moving towards a risk-based vulnerability management strategy. This change aligns with Binding Operational Directive (BOD) 26-04, which mandates federal agencies prioritize vulnerabilities based on real-world exploitation and exposure, rather than solely on severity scores. The agency will continue to provide risk-focused information through its Known Exploited Vulnerabilities (KEV) catalog, alerts, and advisories.","CISA retires its weekly vulnerability bulletin, shifting to a risk-based approach.","https:\u002F\u002Fwww.securityweek.com\u002Fcisa-retires-weekly-vulnerability-bulletin-in-risk-based-pivot\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F04\u002FCISA-Cybersecurity.jpg","2026-09-17T14:28:00+00:00","2026-09-17T18:00:28.532567+00:00",7,[17,20,23],{"name":18,"type":19},"Known Exploited Vulnerabilities catalog","product",{"name":21,"type":22},"CVSS","technology",{"name":24,"type":19},"weekly vulnerability bulletin","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":25,"icon":27,"name":28,"slug":29},null,"Policy","policy",[31,36,38],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"217d3263-c763-41ca-875e-06901f522fe0","NIST","nist",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,24],{"controls":46,"vendors":47},[],[],{"slug":49,"title":50,"body":51,"framework_refs":52,"framework_notes":60},"cisa-shifts-to-risk-based-vulnerability-prioritization-retiring-weekly-bulletin","CISA Shifts to Risk-Based Vulnerability Prioritization, Retiring Weekly Bulletin","CISA's retirement of its weekly vulnerability bulletin signals a critical evolution in how organizations should approach vulnerability management — moving away from static, severity-score-driven prioritization toward dynamic, exploitation-focused risk assessment. Relying solely on CVSS scores has long been a known gap, as high-severity vulnerabilities that are never exploited in the wild may consume resources better spent on lower-scored but actively weaponized flaws. The new strategy, anchored in BOD 26-04 and the KEV catalog, reflects real-world threat intelligence as the primary driver for remediation urgency. Organizations that have not yet adopted a risk-based vulnerability management program are now behind both federal guidance and industry best practice. This shift matters because misallocated patching efforts leave genuinely dangerous vulnerabilities unaddressed while teams chase theoretical risks.",[53,54,55,56,57,58,59],"CISA BOD 26-04","CISA Known Exploited Vulnerabilities (KEV) Catalog","NIST SP 800-40 Rev. 4 – Vulnerability Management Guide","NIST CSF 2.0 – ID.RA (Risk Assessment)","CIS Control 7 – Continuous Vulnerability Management","NIST SP 800-53 RA-3 (Risk Assessment) and RA-5 (Vulnerability Monitoring and Scanning)","EPSS (Exploit Prediction Scoring System) – FIRST.org",{"CISA BOD 26-04":61,"NIST CSF 2.0 – ID.RA (Risk Assessment)":62,"CISA Known Exploited Vulnerabilities (KEV) Catalog":63,"CIS Control 7 – Continuous Vulnerability Management":64,"EPSS (Exploit Prediction Scoring System) – FIRST.org":65,"NIST SP 800-40 Rev. 4 – Vulnerability Management Guide":66,"NIST SP 800-53 RA-3 (Risk Assessment) and RA-5 (Vulnerability Monitoring and Scanning)":67},"This directive emphasises fixing exploited vulnerabilities first, aligning with CISA's move away from severity-driven bulletins.","Risk assessment helps organisations prioritise vulnerabilities based on exploitation and business impact.","The KEV catalogue lists vulnerabilities known to be exploited, a better prioritisation signal than CVSS alone.","Continuous vulnerability management should prioritise exploited flaws over high CVSS scores that are never exploited.","EPSS estimates the likelihood of exploitation, helping prioritise vulnerabilities beyond CVSS scores.","Vulnerability management guidance supports risk-based prioritisation rather than patching by severity score alone.","Risk assessment combined with vulnerability scanning lets organisations focus on what is actually exploitable in their environment."]