CISA Kills Its Own Weekly Vulnerability Bulletin on Sept 28: The CVSS-Ranked List Is Dead, Risk Wins

The short version//

If your patching routine quietly runs on a ranked list, that list is going dark in ten days. On September 16, CISA announced it will discontinue the weekly Vulnerability Bulletin: the CVSS-ranked "top vulnerabilities" email that a lot of homelab patch windows have been built around. The final bulletin ships Monday, September 28, 2026.

CISA's stated replacement signal chain: the KEV catalog, cybersecurity alerts and advisories, and CVE.org, plus "consult vendor and provider advisories directly." The bulletin tells subscribers to re-point their GovDelivery preferences at the Known Exploited Vulnerabilities Catalog and Cybersecurity Advisories topics.

This is not a budget cut. It's an agency publicly admitting that its own ranked list was the wrong unit of work, in writing, with a deadline attached. That makes it rare primary-source news: CISA just told the whole internet that CVSS scores are a starting point, not a to-do list.

The mechanism behind it: BOD 26-04//

The bulletin implements BOD 26-04: Prioritizing Security Updates Based on Risk, published June 10, 2026 (with a matching implementation guidance doc the same day). The BOD does two things worth noticing:

It kills its own predecessors. It "supersedes and hereby revokes" both BOD 19-02 (the 2019 internet-accessible-systems remediation directive) and BOD 22-01 (the 2021 directive that created the KEV catalog). Two directives, one successor. CISA's directives index now lists both as (Revoked) — check it yourself if you want to see the tombstones.

It replaces one score with four questions. The urgency of remediation under BOD 26-04 is determined by:

1. Asset Exposure: Is the vulnerable asset publicly exposed?
2. KEV Status: Is the CVE on CISA's Known Exploited Vulnerabilities catalog?
3. Exploit Automation: Can an adversary automate all the steps needed to exploit it?
4. Technical Impact: Does exploitation give partial control or total control of the asset?

CISA publishes answers for KEV status, exploit automation, and technical impact for every CVE ID through its Vulnrichment Program — so three of the four variables are already computed for you, per CVE. You only have to answer question one yourself: is this asset exposed on my network?

The remediation timelines in the directive's Table 1 are informed by SSVC (Stakeholder-Specific Vulnerability Categorization), and they're dynamic: pull an internet-facing box off the internet and its required timeline relaxes; get a CVE added to KEV and it shortens. A score doesn't do that.

Why CISA thinks severity scores failed//

The BOD's background section is more blunt than usual, and it names AI:

"Cyber threat actors exploit unpatched vulnerabilities, and their use of AI may further narrow the time defenders have to react between patch release and possible exploitation."

Treat that as CISA's claim, not settled fact — but notice what follows from it. If attackers can go from CVE publication to working exploit in hours, then "CVSS 9.1 on page two of a weekly email" was already the wrong resolution for prioritization: the list arrived after the exploitable window had opened. The four-variable model front-loads the things that actually predict exploitation (is it being exploited, can it be exploited by machine, is your copy even reachable) instead of re-sorting a static score nobody disputed in the first place.

What replaces the bulletin, concretely//

Old signal	New signal
Weekly CVSS-ranked top list (dead Sept 28)	KEV catalog — what's actually being exploited, with remediation deadlines per entry
"New this week" digest	Cybersecurity advisories — the named-actor and sector alerts you've been reading here all along
One list for everyone	CVE.org + vendor advisories directly, filtered by your exposure

The SecurityWeek and The Register coverage frames it as a "risk-based pivot" — fair, but undersold. The real news is that the agency maintaining the only ranked list of what's being exploited in the wild just said: the ranking was never the point; the exploitation evidence was.

What to do before Sept 28 (and right after)//

1. Re-point your subscriptions today. If you subscribe to CISA's GovDelivery feed, switch from "Vulnerability Bulletins" to the KEV Catalog and Cybersecurity Advisories topics — that's the instruction in the sunset bulletin itself. One email, two minutes.
2. Wire a KEV diff into your week. The catalog is queryable and versioned; a daily "what's new since yesterday" check beats any weekly ranking. (This pipeline does exactly that — the three entries added Sept 16 all shipped here before their remediation clocks ran out.)
3. Answer question one for your own assets. The BOD's first variable is asset exposure, and CISA points at its Internet Exposure Reduction Guidance for how to find out. For a homelab: from outside the house, what can you actually reach? (The 10-minute router hygiene drill ends with exactly this scan.)
4. Stop sorting by CVSS in your head. When a CVE lands, run the four questions — exposure (you), KEV status / automation / impact (CISA already answered via Vulnrichment) — and patch on that ordering. A 9.8 serial server that's firewalled behind a VLAN loses to a 7.5 box sitting on your WAN.

The deadline is real, the replacement chain is documented, and for once the agency doing the re-pointing published the map. The last weekly bulletin lands Monday — make sure whatever replaces it in your routine can actually answer "what should I patch first?" without a score to lean on.