The September 28 retirement changes how subscribers receive security updates, giving businesses a reason to review who turns advisory information into maintenance decisions.
CISA retired its weekly Vulnerability Bulletin on September 28, following a September 16 announcement. The agency said the move supports prioritizing weaknesses by evidence of exploitation and exposure, instead of severity scores alone. CISA’s retirement notice.
The change affects readers who relied on the weekly summaries. The notice names critical infrastructure owners and operators, plus state, local, tribal and territorial partners, among affected readers. CISA says its Known Exploited Vulnerabilities catalog, alerts and advisories, and CVE information remain available. It directs subscribers to select the catalog and Cybersecurity Advisories topics in their subscription preferences, and encourages organizations to consult vendor advisories. Subscription guidance.
For a business, the next step is to assign one person to decide whether an advisory applies to an owned device or enabled feature. Layer8’s Managed IT service documents asset records, patch workflows and exception handling. Within an agreed engagement, Layer8 would use that structure to record the applicability decision, its owner and any reason to defer action.
Acceptance should follow a sample advisory through to a real result: confirm the affected asset or feature, record approval or an explicit exception, verify the approved change, and check that the business service still works. Keep a usable rollback path with the change record. That process could reduce missed work after the bulletin ends, provided inventory is accurate and assigned owners follow through. Receiving replacement emails alone does not demonstrate that a system has been remediated.