CISA Shifts to Risk-Based Vulnerability Management for Federal Agencies

• •CISA has stopped its weekly vulnerability bulletins as of September 28, 2026.
• •The new approach focuses on real-world exploitation evidence for prioritizing vulnerabilities.
• •Agencies must maintain asset inventories and monitor the KEV Catalog for effective risk management.

On September 28, 2026, CISA ended its weekly vulnerability bulletins, transitioning to a risk-based approach for federal agencies. This change emphasizes prioritizing remediation based on real-world exploitation evidence rather than solely on CVSS severity scores. Lindsey Cerkovnik from CISA stated that not all vulnerabilities carry the same risk for every organization. The shift comes as the volume of vulnerabilities continues to rise, compounded by AI's role in both discovering and exploiting these flaws. Agencies are now required to maintain asset inventories and monitor the Known Exploited Vulnerabilities (KEV) Catalog to better assess risks. This approach aims to prevent teams from wasting resources on low-risk vulnerabilities while critical ones remain unaddressed. The EU's Cyber Resilience Act is cited as a related international effort to enhance vulnerability disclosure and prioritization.