CISA ends its weekly vulnerability bulletin, a CVSS-sorted digest that never flagged exploitation

Nine federal deadlines arrived before the digest did

Between Monday 7 and Sunday 13 September 2026, CISA added 14 CVEs to its Known Exploited Vulnerabilities (KEV) catalogue. Nine of them carried a three-day federal remediation deadline that fell on or before Monday 14 September. That Monday was the day CISA released the weekly Vulnerability Bulletin covering the same week, SB26-257.

That issue listed 3,783 CVEs. Six of the 14 exploited CVEs were among them, and one of those six, a Google Chromium V8 flaw, sat under "Severity Not Yet Assigned". Seven of the other eight had appeared in earlier weekly issues, four of them also under "Not Yet Assigned". The eighth, a Cisco Firewall Management Center flaw that its CNA scored CVSS 10.0, never appeared in any weekly issue: it was published on 4 March 2026, during an eight-week stretch in which CISA issued no bulletins at all.

On 16 September CISA announced that it will discontinue the weekly Vulnerability Bulletin on 28 September 2026.

What those numbers do not establish. They do not show that anyone missed a patch because of the bulletin, or that the bulletin was ever meant to warn about exploitation. The KEV due dates bind US federal civilian agencies, not UK organisations. And retiring the bulletin does not retire any data, because every entry in it was taken from CVE records that remain public.

What the numbers do show is narrower and more useful. The weekly bulletin was a list of CVEs published in a given week, sorted by a CVSS score. It never carried an exploitation signal. The thing being switched off was never the thing that told you what to patch first, and any triage process that treated it that way has had a gap for some time.

What CISA announced, and what it did not say

The announcement went to Vulnerability Bulletin email subscribers on 16 September. CISA says it will stop the bulletin "as part of its shift from severity-based vulnerability management to a modern, risk-based approach", and ties the change to Binding Operational Directive 26-04, issued on 10 June 2026.

It names three places where it "will continue to provide risk-focused vulnerability information": the KEV catalogue, CISA Cybersecurity Alerts and Advisories, and CVE. It tells current subscribers to update their GovDelivery or Granicus preferences by selecting the Known Exploited Vulnerabilities Catalog and Cybersecurity Advisories topics, and encourages organisations to consult vendor and provider advisories directly.

A notice now sits at the top of the bulletins page. It dates the change to the end of CISA's 2026 financial year and says newly recorded vulnerabilities remain available on CVE.org. That archive currently lists 1,096 items, the earliest covering 21 January to 3 February 2004.

The Register reported the change the same day. It pointed out that CISA did not explain why it chose to scrap the bulletin rather than adapt it to the new directive. It also suggested the list may simply have grown too large for a weekly email. That suggestion is The Register's inference, not CISA's stated reason, although the volume figures below are consistent with it.

What CISA's announcement and bulletins page state, and what they leave out. Sources: CISA GovDelivery bulletin of 16 September 2026 and the cisa.gov bulletins page, both read on 17 September 2026.

Question	Stated by CISA	Not stated
When does it stop?	28 September 2026, the end of CISA's 2026 financial year	Whether the issue covering the week of 14 September will still be published
Why?	Alignment with BOD 26-04 and a risk-based rather than severity-based approach	Why the format was retired rather than adapted; any subscriber or usage figures
What should readers use?	KEV catalogue, Cybersecurity Alerts and Advisories, CVE.org, vendor advisories	A like-for-like weekly list of newly published CVEs
What must subscribers do?	Switch GovDelivery topics to KEV Catalog and Cybersecurity Advisories	Whether existing subscriptions will be moved automatically
What happens to the archive?	Nothing announced	Whether the 1,096 archived bulletins stay online
Who is affected?	Subscribers, security teams, critical infrastructure and SLTT partners that relied on weekly CVSS-based summaries	How many subscribers there are, in the US or elsewhere

What the bulletin actually contained

Each issue opened with the same description: a summary of new vulnerabilities "recorded in the past week", organised by CVSS base score into High (7.0 to 10.0), Medium (4.0 to 6.9) and Low (0.0 to 3.9), with a fourth table for CVEs without a score. The page also carried a caveat that is easy to skim past: some of the information "is not a direct result of CISA analysis".

It is often described as a weekly summary of the NIST National Vulnerability Database (NVD). That was true of its links until spring 2025, but it has not been true since. The issue for the week of 7 April 2025 (SB25-104) linked each CVE to nvd.nist.gov. From the following issue (SB25-111, week of 14 April 2025) every CVE link points to a record on cve.org, and all 3,783 links in the final full issue do the same. The current introductory text does not mention the NVD. We could not retrieve earlier versions of that text to see whether it once named the NVD.

The scores came from the CVE records themselves. All 2,791 entries in SB26-257's High, Medium and Low tables match the CVSS v3.x base score that the CVE Numbering Authority (CNA) put in its own part of the record. In most cases a CNA is the vendor scoring its own product: that week Microsoft assigned 967 of the CVEs, Adobe 168 and Dell 115. The bulletin did not re-score anything; it sorted what the CNAs had written.

Size of the weekly bulletin, same seven calendar weeks a year apart. Source: CISA weekly bulletins SB25-216 to SB25-258 and SB26-215 to SB26-257, entries counted from the published tables.

Measure	Weeks of 28 Jul to 8 Sep 2025	Weeks of 27 Jul to 7 Sep 2026
Entries across seven issues	5,964	19,807
Average entries per issue	852	2,830
Entries in the High table	1,574	8,130
Largest single issue	1,099	3,882

The final full issue, covering 7 to 13 September, listed 3,783 CVEs from 113 CNAs, 1,700 of them in the High table. For that week the NVD API returns 3,804 CVEs with a publication date in the same seven days, so the bulletin's count equals about 99.4% of that figure.

It was not always that complete. CISA's listing shows no issues for the six weeks beginning 29 September to 3 November 2025, and none for the eight weeks beginning 9 February to 30 March 2026; the next issue in each case covered only its own week. The issues for the weeks of 13 and 20 April 2026 listed 170 and 59 entries, against 1,178 and 1,469 CVEs published in those weeks according to the NVD API, which is roughly 14% and 4%. None of those pages carries a note explaining the shortfall. A team that treated the bulletin as its weekly list of everything new had no list at all for 14 weeks of the past year, and a badly incomplete one for at least two more, without being told.

Two comforting labels, and a third

"High" was a band, not a priority. In the final issue 1,700 CVEs sat in the High table. Five of them were in the KEV catalogue. A CVSS base score describes how bad a flaw could be in the abstract; it says nothing about whether anyone is exploiting it or whether you run the product.

"Not Yet Assigned" did not mean pending, and it did not mean low. It meant the CNA had not supplied a CVSS v3.x score. Of the 992 entries in that table in SB26-257, 984 had no CNA CVSS v3.x score in the record on 17 September. 271 had a CNA CVSS v4.0 score and nothing else, and for 268 of those the CNA's part of the record had not changed since before the issue was released, so the v4.0 score was already there when the bulletin filed it as unscored. 112 of those 268 scored 7.0 or more under CVSS v4.0, and 33 scored 9.0 or more. All 230 CVEs assigned by the Chrome CNA that week went into the same table.

The exploited examples are the sharpest. SB26-250, released on Tuesday 8 September, filed N-able N-central CVE-2026-86218 under "Not Yet Assigned". Its CNA had scored it CVSS v4.0 10.0 on 6 September. CISA added it to KEV the same Tuesday with a due date of 11 September. The two MikroTik RouterOS flaws added on 10 September (CNA CVSS v4.0 9.2 and 8.8) were in the same table of the same issue, and Citrix NetScaler CVE-2026-19490 (CNA CVSS v4.0 9.3) had been filed there in SB26-236 in August.

The third label is CISA's own: "risk-based". BOD 26-04 says CISA publishes KEV status, automatability and technical impact "for every CVE ID" through its Vulnrichment programme, which writes Stakeholder-Specific Vulnerability Categorization (SSVC) decision points into a CISA-ADP container in each CVE record. On 17 September, 3,281 of the 3,783 CVEs from SB26-257 (86.7%) carried that container's SSVC block. The other 502 did not, including all 443 assigned by the Linux kernel CNA that week.

Where SSVC is present, it narrows the field in the way the directive intends. 383 were marked "poc" (proof of concept), 615 as automatable and 1,426 as giving total control; 163 were both automatable and total control. Only six were marked as actively exploited, and all six were already in KEV. For exploitation, the new "risk-based" signal and the KEV are, in practice, the same list. That is not a criticism of SSVC. It does mean the risk-based view still needs two inputs no federal feed provides: whether you run the product, and whether it is exposed.

What the bulletin gave you, and where that now comes from

The weekly bulletin's contents mapped to what remains. Sources: CISA announcement of 16 September 2026, BOD 26-04, NIST NVD news of 15 April and 17 June 2026, CVEProject/cvelistV5 and cisagov/vulnrichment on GitHub, NCSC vulnerability management guidance.

What the bulletin gave you	Where that now comes from	What has no replacement
A Monday email listing CVEs published in the previous week	CVE.org records, the cvelistV5 GitHub repository (updated about every 7 minutes) or the NVD API filtered by publication date	A free, human-readable weekly list curated by CISA
A CVSS band for each CVE	The CNA's own score in the CVE record; CISA-ADP adds CVSS only where the CNA gave none	A routine independent second score: NIST stopped adding its own by default on 15 April 2026
Vendor, product and a short description	The CVE record; the NVD has carried the record's affected-product data since 17 June 2026	NVD product enrichment for CVEs outside its new priority criteria
Reference and patch links	The CVE record's references and the vendor's own advisory	Nothing: the bulletin only linked through
An exploitation signal	It never had one. The KEV catalogue, CISA-ADP SSVC data and vendor advisories	Not a loss
A fixed weekly cadence for a triage meeting	A scheduled query you run yourself	The cadence, unless you build it
A digest a UK team could forward unchanged	NCSC guidance and, for your own IP ranges and domains, NCSC Early Warning	We found no UK weekly CVE digest from the NCSC

The honest summary of the table: one convenience is lost, and it was already weaker than it looked. The data is all still there, and some of it (SSVC, KEV status, affected products) is richer than anything the bulletin printed.

The NVD context matters here. On 15 April 2026 NIST said CVE submissions rose 263% between 2020 and 2025. It now prioritises enrichment for CVEs in the KEV catalogue, software used in the federal government and "critical software", and labels the rest "Lowest Priority". It also said it would no longer routinely add its own severity score where the CNA had provided one. Anyone replacing the bulletin with "just use the NVD" should expect CNA scores and a partial enrichment queue, not a second opinion on every CVE.

If you want the weekly list back, it takes two commands. The first counts and pages through every CVE the NVD records as published in a given week; the second lists KEV additions in the same window with their federal due dates.

# 1. CVEs published in a week (page with startIndex; this week had 3,804)
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-09-07T00:00:00.000Z&pubEndDate=2026-09-13T23:59:59.999Z&startIndex=0" \
  | jq -r '.totalResults'

# 2. KEV additions in the same week, with due dates
curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \
  | jq -r '.vulnerabilities[] | select(.dateAdded >= "2026-09-07" and .dateAdded <= "2026-09-13") | [.dateAdded, .dueDate, .cveID, .vendorProject, .product] | @tsv'

Method, not accusation

CISA's stated reasoning holds together. BOD 26-04 sets federal remediation timelines from four questions: is the asset publicly exposed, is the CVE in KEV, is exploitation automatable, and does it give partial or total control. A digest sorted only by CVSS base score answers none of the four. Keeping it would have sent a signal the directive is trying to retire.

The volume pressure is real too, even though CISA did not cite it. The same seven weeks of issues grew from 5,964 entries in 2025 to 19,807 in 2026, and the High table grew more than fivefold. A table of 1,700 "High" CVEs a week is not something a person can triage.

The fair criticisms are about delivery rather than direction. Subscribers got 12 days' notice (16 to 28 September). The announcement lists CVE.org as a source of "risk-focused vulnerability information", when a CVE record on its own is the same unsorted material the bulletin was built from. And the bulletin's own gaps and shortfalls over the past year went unexplained on the pages themselves.

Commercial interests deserve a plain note. CVSS scores in CVE records are frequently set by the vendor of the affected product. Two of the most active CNAs in the final week, VulnCheck (329 CVEs) and VulDB (177), are companies that sell vulnerability intelligence, and vendors in that market can be expected to pitch themselves as the bulletin's replacement. None of that makes their data wrong. It is a reason to know whose score you are reading.

The UK angle: MSPs and the Monday triage meeting

We have no figures for how many UK teams or managed service providers used the CISA bulletin, and CISA published none. Where a UK team did use it as a weekly digest, three points from UK sources matter more than the bulletin itself.

First, the NCSC's own urgent timelines already run on CISA's KEV, which is not going away. Its guidance on responding to active exploitation (version 2.1, published 1 May 2026) sets compressed update times for business-critical systems when a CVE is on the KEV. Those times are shorter than the federal ones in BOD 26-04.

NCSC compressed timelines for KEV-listed vulnerabilities in business-critical systems, compared with BOD 26-04. Sources: NCSC vulnerability management guidance, section 2 (version 2.1, 1 May 2026); BOD 26-04 Table 1.

KEV case	NCSC: install update within	BOD 26-04 federal timeline
Internet-facing, automatable, total control	Immediately, under 24 hours, plus a Cyber Incident Response investigation	3 days and forensic triage
Internet-facing, not automatable, total control	Under 48 hours, plus a Cyber Incident Response investigation	3 days and forensic triage
Not internet-facing, automatable, total control	Under 72 hours, plus a Cyber Incident Response investigation	3 days and forensic triage

Second, the NCSC warns against leaning on any agency feed. Its guidance says organisations "should not solely rely on notifications from the NCSC or other cyber agencies", because agencies typically report flaws in widely deployed software. It also recommends vulnerability assessments across the whole estate at least monthly. For UK organisations, the NCSC's free Early Warning service sends alerts about malware and vulnerable services tied to the IP addresses and domain names you register through MyNCSC. It does not scan your network itself, and it is not a CVE digest.

Third, the NCSC expects the volume problem to get worse. In a blog post of 1 May 2026, NCSC chief technology officer Ollie Whitehouse told organisations to prepare for a "patch wave" as AI, in skilled hands, exposes decades of technical debt. He advised prioritising updates to the external attack surface and suggested a risk-prioritised approach such as SSVC.

For MSPs specifically, look again at the week of 7 September. Two of the 14 KEV additions were remote management products, N-able N-central and ConnectWise ScreenConnect, both with three-day federal deadlines. An MSP's own tooling is the attack path into every client, and neither the bulletin nor its retirement changes that. The NCSC guidance also says critical suppliers and managed service providers should be contractually obliged to fix exploited flaws in internet-facing systems quickly. That puts the question on the client's side of the contract as well.

What to do, in order

The question the retirement exposes

If your Monday triage would run exactly the same way without CISA's bulletin, it was never a control, and nothing is lost on 28 September. If it would not, ask what in your process flagged N-able N-central as urgent on Tuesday 8 September. The only weekly digest that listed it that day filed it under "Not Yet Assigned", and CISA's deadline for it expired three days later.

Key facts