CISA has stopped sending the weekly vulnerability list. Read this one instead.
Whoever looks after security at your business has a way of hearing about new vulnerabilities. For a lot of people it was an email: a weekly list of everything published, sorted by severity, with the worst at the top.
The best-known of those emails stopped on 28 September. If your patching routine started with it, or with anything like it, this is a good week to change the routine. The list was already too long to use, and sorting it by severity was pointing people at the wrong things.
What changed
CISA, the US government's security agency, has ended its weekly vulnerability bulletin. It says the move is part of a shift from managing vulnerabilities by severity score to what it calls a risk-based approach.
That approach was set out in June, in a directive to US federal agencies. It tells them to stop treating every high-scoring flaw as equally urgent and to set deadlines from four plain questions:
- Can the affected system be reached from the internet?
- Is the flaw known to be exploited already?
- Can an attack on it be fully automated?
- Does it give an attacker full control, or only partial access?
The answers map to a deadline. An internet-facing system with a known-exploited flaw that hands over full control gets three days and an instruction to check whether someone has already got in. An internal system with a flaw nobody is exploiting and nobody can automate waits for the next planned upgrade. In between sit 14 and 60 days.
None of this binds a UK business. It is still the clearest published answer to "what do we fix first", and it is free to borrow.
Why the weekly list had stopped working
The numbers explain the decision better than the announcement does.
The US National Vulnerability Database recorded 4,537 new vulnerabilities in September 2025. In September 2026 it recorded 15,074. That is about 3,500 a week. No one reads an email with 3,500 entries.
Sorting by severity does not rescue it. We looked at every vulnerability published so far this year:
- 8,813 scored critical, meaning 9.0 or higher out of 10.
- 98 of those are on CISA's list of flaws confirmed as exploited. That is 1.1%.
Now turn it round. CISA has added 249 vulnerabilities to that exploited list in 2026, up to 2 October:
- 129 of the 249 scored below 9.0. A "criticals only" rule would have skipped more than half of the flaws attackers were actually using.
- 17 scored below 7.0, which most patching policies treat as routine.
- 27 are marked as known to be used in ransomware attacks.
So the severity filter fails in both directions. It hands you thousands of things that nobody is attacking, and it hides half of the ones somebody is. We found the same pattern across the whole public record in 99% of critical vulnerabilities are never exploited by anyone.
The list that is short enough to read
CISA's Known Exploited Vulnerabilities catalogue is the replacement it points people to. It lists flaws with confirmed attacks behind them. At 249 additions in nine months, it grows by about six a week.
It is fast, too. Of the 178 flaws that were both published and added to the catalogue this year:
- half were listed within 4 days of publication
- 105 were listed within a week
- 52 were on the list on or before the day they were published, because attackers found them first
That last figure is why a monthly patching cycle is not enough on its own. For nearly a third of this year's exploited flaws, the attack came before the announcement.
The same names keep appearing. Microsoft accounts for 39 of the 249, Cisco for 18, Apple for 9, and Fortinet and Google for 8 each. Most small businesses run something from at least two of those.
What to do
- Write down what you run. You cannot match a list against software you have not listed. Operating systems, the firewall and router, remote access, email, the website platform and its plugins, and anything a supplier hosts for you.
- Mark what faces the internet. It is the first of the four questions, and nobody outside the business can answer it for you.
- Follow the exploited list, not the full list. CISA publishes the catalogue as a web page and as a data feed. If you were subscribed to the weekly bulletin, CISA says to switch your subscription to the catalogue and its advisories.
- Agree deadlines before you need them. Three days for anything internet-facing and exploited that gives an attacker full control. Fourteen for most of the rest of the exploited list. Write it down, so nobody has to argue priority during an incident.
- Ask your IT provider how they choose. "We patch criticals within 14 days" is a common answer. This year it would have missed more than half of the flaws being used. The better answer mentions exploitation and exposure.
- Treat "exploited and internet-facing" as two jobs. Patch it, and check it was not used before you patched. There is more on choosing what to patch first in the patching rule that beats "just do the criticals".
How Steelwise can help
Turning "we patch when we can" into a short written rule, with a list of what you run and who is responsible for each item, is a small piece of security advisory work. Get in touch if you would like help with it.
About the data. Vulnerability counts by severity and the timing figures come from our analysis of public vulnerability records sourced via StackFlag, which is a Steelwise product, queried on 4 October 2026. The exploited-list figures are taken from CISA's catalogue (version 2026.10.02), and we checked the 249 total and the ransomware count against CISA's own feed. The September totals are the National Vulnerability Database's own counts. The catalogue records confirmed exploitation, not all of it, so the exploited figures are a floor. Publication dates are to the day, so "within 4 days" is approximate. StackFlag now applies the directive's four questions to software you tell it you run, and explains how. Where CISA has not assessed a flaw, StackFlag estimates two of the four answers, and those estimates differ from CISA's about one time in ten.