Bulletins Archive

Archived Content: In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.

CISA will discontinue the weekly Vulnerability Bulletin at the end of FY26 (September 28, 2026) as part of a broader shift from severity‑based vulnerability management to risk‑based vulnerability prioritization. Newly recorded vulnerabilities remain available on CVE.org, and users should rely on the Known Exploited Vulnerability (KEV) Catalog, CISA Cybersecurity Alerts and Advisories, and vendor security alerts for actionable, risk‑based updates.

Visit our Subscribe to Updates page to sign up to receive automatic updates from CISA with the latest news and information.