CISA’s latest Vulnerability Review finds that most of the flaws attackers actually exploited in 2024 and 2025 were not novel or exotic. Seven of the top ten most exploited CVEs in 2024, and seven of the top ten entries in the agency’s Known Exploited Vulnerabilities catalog, trace back to weakness classes MITRE has tracked as “stubborn” for years: improper input validation, path traversal, and OS command injection among them. Memory safety and input validation issues alone accounted for 16.7 percent of everything added to the KEV catalog in 2025.
CISA’s own framing puts the blame on process, not technical difficulty. “Threat actors continue to succeed, in part, because simple, preventable software weaknesses remain unaddressed. Resolving fundamental issues would eliminate a significant portion of today’s most common compromises,” the agency said in the report, attributing the persistence of these bug classes to organizational culture, developer workflow, and gaps in Secure by Design adoption rather than the difficulty of fixing them.
For a security leader, the finding is a useful corrective to how patch prioritization usually gets argued inside an organization. It is easy to assume the biggest exploitation risk sits with the newest, highest severity disclosures, the kind CyberTech has covered in pieces like why a CVSS 10.0 score does not tell you what to patch first. CISA’s data says otherwise: a meaningful share of what gets exploited is old, well understood, and has existed in vendor codebases for years, which means it is a development and testing gap as much as a patch management one.
The original insight is where this leaves accountability. If the same weakness classes keep reappearing across unrelated vendors and unrelated products, the fix is not one more patch cycle. It is holding software suppliers to secure development practices that catch these bug classes before shipping, the same argument CyberTech made in our recent opinion on why a patch existing is not the same as a flaw being fixed in practice. CISA’s review gives that argument a federal data set behind it.
Source: CISA
