CISA Retires the Weekly Vulnerability Bulletin on 28 September. Your Postmarket Triage Should Already Be Risk Based
FDA points device manufacturers at the same KEV Catalog and a high CVSS score is not a reason to drop everything
Andrew Chukwu, CISSP, MBA | Editor-in-Chief
Sep 19, 2026
If your post-market surveillance procedure names the CISA weekly Vulnerability Bulletin as an input, you have less than ten days to rewrite it. CISA announced on 16 September that it will discontinue the bulletin on 28 September as part of its shift from severity-based vulnerability management to a risk-based approach, and pointed subscribers instead to the Known Exploited Vulnerabilities Catalog, its Cybersecurity Alerts and Advisories, and the CVE programme. CISA also encourages organisations to consult vendor advisories directly.
For anyone running postmarket surveillance on a medical device, the useful question is not which feed replaces the bulletin. It is whether your triage still begins with a score.
CISA ties the decision to Binding Operational Directive 26-04, which sets remediation urgency using four questions:
Is the vulnerable asset publicly exposed?
Is the CVE in the KEV Catalo?
Can an adversary automate all the steps needed to exploit it?
What technical impact does exploitation give?
For Medical Device Manufacturers, this lands in post-market surveillance
FDA points at the same catalogue. Its premarket cybersecurity guidance sets out the elements of a Cybersecurity Management Plan, which is the plan required under section 524B(b)(1) of the FD&C Act to monitor, identify and address postmarket vulnerabilities and exploits. One of those elements is identifying and addressing vulnerabilities listed in CISA's KEV Catalog. Neither expectation is new. What changes on 28 September is that the severity-ordered summary sitting alongside them disappears, and the sources that remain are the ones built on evidence of exploitation.
The harder habit to break is the reflex that a high CVSS score means stop everything and patch. In postmarket surveillance the question FDA asks is whether the risk of patient harm is controlled or uncontrolled, and that turns on exploitability together with the severity of harm if the vulnerability were exploited. A score describes technical severity in a generic system. It does not tell you whether anyone is exploiting the vulnerability, whether your device is reachable, or what happens to the patient if it is.
That is where CISA's four factors earn their place inside a device process and once you put them into context you'll have a defensible reason to treat one 7.5 as urgent and one 9.8 as not so urgent, recorded in a form a reviewer or an auditor can follow. Exposure is also the factor you can change without touching code, through the compensating controls you already document. Severity of patient harm stays yours to determine, because no scoring system carries it.
Two of the four factors move quickly, and AI is why. Evidence of exploitation and the availability of working exploit code can appear within days of disclosure. A vulnerability you closed as controlled risk last quarter can become uncontrolled risk without anything in your product changing.
Quick ToDos
Remove the weekly bulletin from your surveillance procedure and name KEV, CISA advisories, CVE and your component vendors' advisories as the replacement inputs. Do it before 28 September.
Define in writing what "reliable evidence of active exploitation" means for your products, and who decides.
Record exposure, KEV status, automation and technical impact as fields in your triage record, feeding the exploitability side of the controlled or uncontrolled decision
Map your SBOM components to KEV on a schedule, not on request.
Write down what triggers re-triage of a vulnerability already closed as controlled. Addition to KEV should be one of those triggers.
Primary Sources & Further Reading
How did this land?
Be the first to react.