Agency's shift from static CVSS scores to risk-based prioritization sends the old format packing September 28
If you rely on the Cybersecurity and Infrastructure Security Agency’s weekly vulnerability bulletin to keep you up to date on the latest threats, we have bad news. It’s being discontinued at the end of September.
CISA announced on Wednesday that its weekly vulnerability bulletin would stop going out on Monday, September 28, saying the move was part of its shift from managing vulnerabilities based on severity to “a modern, risk-based approach.”
That approach, as CISA explains, is detailed in a June Binding Operational Directive (BOD) that explains how covered federal civilian agencies should prioritize security updates based on real-world risk rather than treating all vulnerabilities and systems equally.
“This Directive evolves upon CISA’s known exploited vulnerabilities catalog and increases mission readiness across the federal government by efficiently prioritizing high-risk vulnerabilities for timely action, while deferring action against low-risk vulnerabilities,” the agency explained in June.
Evidence of exposure and exploitation, degree of control granted by exploitation, and whether exploitation of the vulnerability can be automated are all part of what goes into determining severity, according to a remediation table included in the June announcement.
The June BOD, in a sense, moves covered federal civilian agencies away from relying on static CVSS scores alone when prioritizing vulnerabilities, which helps explain why CISA might want to eliminate the weekly bulletin. The agency didn’t explain, however, why it chose to scrap the bulletin rather than adapt it to the BOD's new standards.
One possibility could be that the list of new vulnerabilities is getting too big to fit into a weekly email. Patches are addressing rapidly numbers of vulnerabilities every time they roll out thanks to AI-assisted security research, while the National Vulnerability Database is still facing a large backlog and the broader CVE ecosystem is having to sift through bogus AI-generated reports to identify genuine vulnerabilities.
CISA doesn’t want security professionals to abandon CVEs altogether, however. The announcement mentions that those who need to stay up to date on vulnerability information should instead rely on CISA’s known exploited vulnerabilities catalog, its cybersecurity alerts and advisories, and the CVE catalog itself.
That means anyone who currently receives and relies on the weekly bulletin needs to log into the GovDelivery or Granicus account and ensure the KEV Catalog and Cybersecurity Advisories subscriptions are enabled. Notices could be missed if not, and CISA isn’t too concerned about the potential hiccups this might cause.
“CISA remains committed to strengthening national cyber defense and helping organizations prioritize remediation based on real-world risk,” the agency said. It doesn’t believe cutting off a regular method of notifying users of critically ranked vulnerabilities falls inside that new risk paradigm, even if the scores are static. ®