CISA’s review finds that the most frequently exploited bugs are not exotic or new. They are decades‑old classes of errors — things software engineers have known about for years — that persist because they are not being designed out of products. The agency examined CVE records and the Known Exploited Vulnerability (KEV) catalog and concluded that the majority of entries belong to long‑standing weakness types that should have been eradicated.
Improper input validation (CWE‑20) and the KEV catalog
Improper input validation (CWE‑20) emerged as the single most common weakness across both the KEV catalog and registered CVEs, CISA reported. Three of the top five KEVs stemmed from long‑unfixed holes; those three are improper input validation (CWE‑20), path traversal (CWE‑22), and OS command injections (CWE‑78). In 2024, seven of the 10 most frequent CWEs on the CVE list belonged to MITRE’s “stubborn weaknesses,” and seven of the top 10 CWEs on the KEV catalog made up 41.5 percent of the KEV list — a concentration CISA says directly links these classes to real‑world exploitation.
Injection flaws: XSS (CWE‑79), OS command injection (CWE‑78), SQLi (CWE‑89)
Injection‑related vulnerabilities repeatedly appear across both CVE and KEV records for 2024–2025. Cross‑site scripting (CWE‑79), OS command injections (CWE‑78), and SQL injection (CWE‑89) were among the most common flaws identified. CISA’s Risk and Vulnerability Assessments (RVAs) — the agency’s no‑cost penetration tests on real organizations — reinforced that memory safety and improper input validation are the most reliable paths to exploitation, and that injection vulnerabilities remain commonly seen in registered CVEs. The agency noted, however, that injection flaws are less frequently successfully exploited in the wild against cyber‑mature organizations.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleMITRE’s “unforgivable” (2007) and “stubborn” (2023) findings persist
CISA tied its findings to two MITRE reports cited repeatedly over the years. A 2007 paper described “unforgivable vulnerabilities” — errors that arise from common, well‑documented mistakes, have an “obvious” attack path, simple exploits, and can be found by attackers in minutes. A 2023 work catalogued “stubborn weaknesses.” In CISA’s 2024 data, seven of the 10 most frequent CWEs on CVE lists match MITRE’s 2023 stubborn weaknesses; in 2025, seven of the top 10 CWEs were still those MITRE had called unforgivable nearly two decades earlier. CISA emphasizes that these repeat offenders demonstrate the problem is not primarily technical complexity but organizational culture, developer workflows, and systemic gaps in Secure by Design adoption.
CISA’s Secure by Design prescription and practical steps
To reduce exploitability, CISA is urging broad adoption of Secure by Design (SBD) practices. The agency’s guidance stresses that vendors must “own security outcomes” for customers, eliminate stubborn and unforgivable weaknesses, and improve automation for configurations, monitoring, and updates. CISA also recommends that software buyers select vendors that meet those requirements and that organizations maintain software bills of materials (SBOMs) to track supply‑chain risk. The agency argues this is preferable to the current cycle of ever‑larger patch packages: “Instead of releasing patch packages that continue to swell to record sizes, just build the software responsibly in the first place,” CISA wrote.
What this means for software buyers, defenders, and vendors
- Software buyers: Prioritize vendors that provide SBOMs and demonstrate Secure by Design practices; CISA says buyers should choose vendors that “own security outcomes.”
- Defenders and security teams: Expect the KEV catalog to remain dominated by long‑standing classes of weakness; RVAs show memory safety and improper input validation are reliable exploitation paths to monitor and mitigate.
- Vendors and developers: The agency frames the core problem as organizational and process‑driven — developer workflows and culture — and urges elimination of stubborn/unforgivable weaknesses through SBD, automation of updates and monitoring, and taking responsibility for customer security outcomes.
CISA’s message is unambiguous: the most exploited vulnerabilities today map back to mistakes known for years, and fixing them requires changing how software is built and procured rather than merely reacting to incidents. The agency ends with a challenge that shifts the burden — from defenders scrambling to patch swelling bundles to vendors “owning” security by design — and a call for leadership attention to treat cyber risk as a business risk, a national security threat, and an impediment to operational resilience.
