SecurityWeek (17 September 2026) reports that CISA has discontinued its Weekly Vulnerability Bulletin — the alphabetical product dump of newly recorded CVEs with severity/CVSS/patch fields but no exploitation context. CISA framed the change as aligning with Binding Operational Directive (BOD) 26-04 (June), which directs US federal agencies to prioritise remediation using real-world risk factors including evidence of exploitation and exposure, not severity scores alone.

CISA continues risk-focused output via the Known Exploited Vulnerabilities (KEV) catalog, alerts, and advisories. Practical takeaway for AU SOCs that mirrored the bulletin: shift intake to KEV plus vendor PSIRTs / NVD / ASD-ACSC alerts rather than expecting a CISA weekly CVE dump.

Correction (25 Oct 2026): CISA's own notice of 16 September 2026 said it would discontinue the weekly Vulnerability Bulletin on 28 September 2026, so when SecurityWeek reported on 17 September the change had been announced but had not yet taken effect.

The notice names the KEV catalog, CISA cybersecurity alerts and advisories, and CVE as the continuing sources. The earlier note that no CISA page could be found has been removed. (source: CISA bulletin notice (GovDelivery))