CISA is ending its monthly vulnerability bulletin
Summary
CISA is discontinuing its weekly bulletin of known vulnerabilities effective September 28th. This change is attributed to the implementation of Binding Operational Directive (BOD) 26-04, which prioritizes patching based on real-world risk factors rather than solely severity scores. CISA will continue to share information through other channels like its Known Exploited Vulnerabilities (KEV) catalog.
IFF Assessment
The discontinuation of a regular vulnerability bulletin by a key government agency may reduce the accessibility of timely threat intelligence for defenders.
Defender Context
Defenders should note the shift in how CISA communicates vulnerability information. They will need to rely on alternative CISA resources and vendor advisories more heavily. This change might require defenders to proactively seek out and correlate threat intelligence from multiple sources to stay adequately informed about emerging risks.