Loading story…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) will discontinue its weekly vulnerability bulletin on September 28, 2026, replacing a broad list of newly disclosed flaws with a risk-based approach to remediation. The retired bulletin did not prioritize fixes and could contribute to alert fatigue by cataloging thousands of vulnerabilities without distinguishing those posing the greatest operational threat.
The change supports Binding Operational Directive 26-04, which requires covered federal civilian agencies to weigh real-world factors such as confirmed exploitation, internet exposure, attacker control obtained through exploitation, and the potential for automated exploitation rather than relying on CVSS severity alone. CISA will continue publishing actionable vulnerability information through its Known Exploited Vulnerabilities (KEV) Catalog, cybersecurity alerts, advisories, and the CVE Catalog; existing subscribers should enable relevant GovDelivery or Granicus notifications.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
CISA published BOD 26-04 directing covered federal civilian agencies to prioritize vulnerability remediation based on real-world risk factors, including exposure, exploitation evidence, potential control gained, and exploit automation rather than CVSS scores alone.
CISA introduced the Known Exploited Vulnerabilities (KEV) Catalog, which focuses on vulnerabilities with documented exploitation in the wild.
CISA announced it will discontinue its weekly vulnerability bulletin as part of its transition to risk-based vulnerability management. It said users should instead use the KEV Catalog, CISA alerts and advisories, and the CVE Catalog for vulnerability information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA has ordered U.S. federal civilian agencies to move away from deadline-driven patching based primarily on CVSS scores and adopt a risk-based remediation model under **Binding Operational Directive `26-04`**. The directive ties remediation timelines to factors including public exposure, Known Exploited Vulnerabilities status, exploit automation, and technical impact, and it also requires forensic checks for the highest-risk flaws because patching alone may not remove an existing compromise. The order consolidates earlier directives and gives agencies 180 days to fully align their vulnerability handling processes. The policy shift comes as NIST seeks public input on a broader overhaul of the **National Vulnerability Database** to support AI-era vulnerability reporting and machine-consumable security data. NIST said rising disclosure volume, inconsistent data quality, and growing reliance on automation are making static prioritization and manual remediation increasingly inadequate, and it is asking stakeholders how AI should be integrated into reporting, dissemination, transparency, auditability, and remediation workflows. Together, the efforts signal a federal push toward faster, context-aware vulnerability prioritization and response.
Aug 13, 2026
CISA issued **Binding Operational Directive `26-04`** requiring U.S. federal civilian agencies to prioritize vulnerability remediation by risk instead of treating all flaws as equally urgent. The directive tells agencies to rank vulnerabilities using four factors: whether the affected asset is public-facing, whether exploitation can be fully automated, whether compromise could enable full system takeover, and whether there is evidence of active exploitation, including inclusion in CISA’s **Known Exploited Vulnerabilities** catalog. Based on those criteria, agencies now face remediation deadlines ranging from **three days** for the highest-risk cases to **60 days** for lower-priority flaws, while some low-risk issues may be deferred until a planned major system upgrade. CISA said the overhaul is meant to help agencies “patch smarter, not harder” as AI shortens the time between disclosure and weaponization and defenders struggle with limited resources. Agencies must immediately update vulnerability management policies, revise remediation processes within 60 days, and fully implement the directive’s timelines within 180 days; vulnerabilities meeting all four criteria also require forensic triage to determine whether systems were already compromised before patching. CISA said an initial review at one large civilian agency found only about **1%** of vulnerability instances would require the three-day response, while more than **60%** could be deferred, and the agency urged private-sector organizations to adopt similar risk-based practices alongside hardening, segmentation, and phishing-resistant MFA.
Jul 13, 2026
CISA’s vulnerability review of fiscal years 2024–2025 found that damaging compromises predominantly resulted from opportunistic exploitation of known, internet-exposed vulnerabilities and fundamental security failures—not zero-days or highly sophisticated campaigns. The affected weaknesses frequently involved memory safety, injection, and improper input validation; **41.5%** of known exploited vulnerabilities mapped to persistent MITRE CWE Top 25 weakness classes. CISA reported widespread risk from vulnerable exposed services, unsupported software, and deprecated SSL/TLS, and warned that CVSS scores alone are insufficient for remediation decisions. Its Binding Operational Directive 26-04 prioritization framework weighs internet exposure, Known Exploited Vulnerabilities Catalog status, likelihood of automated exploitation, and technical impact; recommended actions include rapidly remediating exposed KEVs, retiring end-of-support systems, strengthening input validation, and adopting Secure by Design practices such as memory-safe languages and SBOMs.
Aug 28, 2026