Reviewed: September 18, 2026.
What happened
Dark Reading reported that CISA plans to discontinue its weekly vulnerability bulletins effective September 28. Newly recorded vulnerabilities will remain available through CVE.org, while CISA is directing defenders toward its Known Exploited Vulnerabilities catalog, cybersecurity alerts and advisories, and vendor notices for more actionable updates.
Why it matters
A severe score describes technical potential, but it does not show whether a flaw is being exploited, whether the vulnerable service is exposed, or whether it sits on a business-critical system. A risk-based queue combines exploit evidence with asset importance, exposure, technical impact, and the organization's ability to detect or contain abuse.
What to do
- Keep a current inventory so each vulnerability can be tied to a real device, application, owner, and business function.
- Move KEV-listed and actively exploited flaws to the front of the remediation queue.
- Use CVSS as one input—not the entire decision.
- Record the patch, mitigation, exception, and verification evidence so risk decisions can be defended later.
Reporting: Dark Reading, September 17, 2026
Primary resource: CISA Known Exploited Vulnerabilities Catalog
Primary resource: CISA Cybersecurity Alerts & Advisories
Panther Note
The goal is not to ignore vulnerabilities. It is to stop treating every number as equal and put limited time where the evidence says an attacker can do the most harm.