For more than two decades, the Cybersecurity and Infrastructure Security Agency (CISA) published a weekly bulletin listing newly disclosed vulnerabilities, their CVE identifiers, severity scores, and brief descriptions. On September 28, 2026, those bulletins ended and with that change it marked the move from just measuring the vulnerability discovery to addressing the exploitations that need to be validated.
CISA says the decision reflects its shift from severity-based vulnerability management to a modern, risk-based approach. Instead of treating a CVSS score as the primary measure of urgency, the agency wants federal teams to prioritize remediation using real-world evidence of exploitation and exposure.
The reason is straightforward: vulnerability volume continues to grow, and AI is accelerating both vulnerability discovery and attackers’ ability to operationalize new exploits. Defenders cannot patch everything at once. They need a better way to determine what matters most.
As Lindsey Cerkovnik, CISA’s branch chief for vulnerability response and coordination, recently put it: “Not all vulnerabilities matter. Not all vulnerabilities that do matter matter at the same level for you and your organization.” That is more than a change in patching timelines. It signals a broader evolution in how federal agencies should think about cyber risk.
Severity Alone Cannot Determine Priority
Agencies now need to discover weaknesses, maintain accurate asset inventories, monitor the Known Exploited Vulnerabilities (KEV) Catalog, and patch affected systems.
The problem with just doing vulnerability discovery was it becomes the basis for prioritization without enough context.
The Common Vulnerability Scoring System (CVSS) describes the technical severity of a vulnerability under defined conditions. It does not show whether an affected system is accessible to an attacker, whether compensating controls prevent exploitation, or what an attacker could reach after gaining access.
The reality is that two agencies can operate the same vulnerable product and face very different levels of risk. In one environment, the affected system may be isolated and protected by effective controls. In another, the same weakness may provide initial access, expose privileged credentials, and create a path to systems supporting critical operations. The vulnerability is the same. The exposure and potential mission impact are not.
Other related international examples include the EU’s Cyber Resilience Act that ensures manufacturers now disclose actively exploited flaws and severe security incidents through ENISA’s new reporting platform to ensure proper disclosure on exploitation to aid in that prioritization.
When every critical finding enters the same remediation queue, teams can spend limited time patching vulnerabilities that pose little immediate risk while more consequential exposures remain unresolved. That is the challenge with patching by severity alone: teams are forced to make remediation decisions without enough evidence about attacker opportunity and impact.
Prioritizing Security Updates Based on Risk
CISA’s Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk, gives federal civilian agencies a more practical model.
The directive bases remediation timelines on four factors:
- Whether the affected asset is accessible from the internet
- Whether the vulnerability is known to be actively exploited
- Whether exploitation can be automated
- The level of control an attacker could gain through successful exploitation
Together, these factors provide a stronger indication of urgency than severity scores alone. An actively exploited, automatable vulnerability that could provide control of an internet-facing system warrants a different response than an equally severe weakness on an internal system that attackers cannot reach.
This helps agencies direct limited resources toward the vulnerabilities most likely to create immediate risk. But it also raises the next set of questions.
Is the weakness exploitable in this specific environment? What could an attacker do with the resulting access? Could it be combined with exposed credentials, identity misconfigurations, or other security gaps? What systems and data could an attacker ultimately reach?
External intelligence and standardized risk factors cannot fully answer those questions. Agencies need evidence from inside their own environments.
Exposure Management for the Win
This is where the conversation moves from vulnerability management toward exposure management.
Attackers do not experience an environment as a list of isolated CVEs. They find combinations of vulnerabilities, credentials, misconfigurations, identity relationships, and control gaps that allow them to progress toward a target.
A vulnerability that appears critical on its own may lead nowhere. A series of individually less severe weaknesses may combine into an attack path that results in privileged access or the compromise of critical infrastructure.
Exposure management looks at those relationships. It asks whether an attacker can use the conditions present in the environment, what path they can take, and what impact they can achieve.
Validation provides the evidence. By safely testing production environments from an attacker’s perspective, agencies can determine whether a weakness is actually exploitable, identify the attack path it enables, and understand the potential mission impact.
That evidence makes prioritization more useful. It complements CISA’s risk factors by showing how they translate into attacker opportunity within a particular agency.
Remediate the Attack Path, Not Just the Finding
Understanding the attack path can also change the remediation decision.
Suppose an attacker uses a weak credential to access a server, escalates privileges, extracts a privileged credential, and moves laterally to critical infrastructure. Changing the original credential may interrupt that specific route, but it does not necessarily address the broader exposure.
The agency may also need to prevent privilege escalation, protect credential material, restrict where administrative identities can authenticate, and limit lateral movement to critical systems.
The objective is not simply to close the first finding. It is to remove the conditions that allowed an attacker to turn that weakness into mission impact.
This context can also strengthen Plan of Action and Milestones decisions. Remediation owners, due dates, exceptions, compensating controls, and residual risk can be evaluated against a demonstrated attack path rather than an aging finding alone.
Verification Proves the Risk Was Reduced
Remediation does not automatically mean the exposure is gone.
A patch may not have reached every affected asset. A configuration change may not work as intended. A compensating control may block one technique while leaving another path to the same target. Closing a ticket proves that an action was taken, not that the original impact is no longer achievable.
Verification closes that gap.
After remediation, agencies should retest the exposure and attempt to reproduce the original attack path. This allows them to confirm that the weakness is no longer exploitable, the path to the affected assets has been broken, and another route does not still lead to the same impact.
Validation proves what an attacker can do before remediation. Verification proves whether they can still do it afterward.
The Exploitation Evolution
CISA is not telling agencies to stop managing vulnerabilities.
It is telling them to stop treating every vulnerability as though it presents the same level of risk.
That is an important step. The next is connecting CISA’s risk-based prioritization model with evidence from the environment itself.
The NodeZero® Proactive Security Platform adds environment-specific evidence to CISA’s risk factors by showing whether a weakness is exploitable, the attack path it enables, and whether remediation changed the outcome. It complements vulnerability scanners, asset inventories, threat intelligence, patch management, and established remediation processes by helping federal teams understand which exposures demand action.
Federal agencies will never have unlimited time or resources to patch every vulnerability immediately. But they can make better decisions about what to fix first.
It’s time to stop patching blindly. Find the exposures attackers can use, understand where those exposures lead, and prove that the fixes changed the outcome.
What does this shift mean for your agency’s next remediation decision? Join me and CISA’s Jahanzeb Khan on November 12 at 11 a.m. ET for Racing the Exploit Clock: Vulnerability Management for the AI Era. We’ll discuss how continuous validation helps agencies prioritize fixes, reassess accepted risks, and prove that exploitable paths to mission-critical systems have been reduced.