CISA set September 28 as the end of its weekly Vulnerability Bulletin. Its September 16 announcement pointed readers toward the Known Exploited Vulnerabilities catalog, alerts and vendor advisories instead.
The reason it gave is useful beyond the mailing list: prioritize real-world risk, including exploitation and exposure, rather than severity scores alone.
A vulnerability score describes the vulnerability. Your patch decision also needs to describe the system you run. Is the affected version installed? Can someone reach the vulnerable service? Is there evidence of exploitation? What happens to the business if that system fails?
Without that context, a team can spend the week closing impressive numbers while a reachable, actively exploited weakness waits further down the spreadsheet. The report looks busy. The patch order may still be wrong.
I'd put the affected asset beside each finding and give the remediation an owner. Check the vendor advisory for the actual version and fix. When evidence of exploitation changes the urgency, update the queue instead of waiting for the next reporting cycle.
This also takes coordination with operations. A patch can need a maintenance window or a recovery plan. Write down the reason for a delay and any temporary protection, then revisit it. "Scheduled" shouldn't become a permanent exemption.
For a Canadian business, CISA's federal directives aren't automatically a local obligation. The practical lesson is still useful: combine exploitation evidence with your own exposure and business impact.
A score can help sort a list. It can't finish the decision about what you should fix first.