CISA VULNERABILITY REVIEW WARNS BASIC SOFTWARE FAILURES STILL DRIVE MOST CYBER COMPROMISES

THREAT SUMMARY

Category: Vulnerability Management / Secure by Design
Affected Product(s): Broad software, internet-facing systems, edge devices, legacy infrastructure, IT and operational technology environments
Primary Risks: Known exploited vulnerabilities, insecure software design, injection flaws, improper input validation, memory-safety weaknesses, exposed services, unsupported software, weak authentication, AI-assisted exploitation
Threat Status: Active and persistent
Affected Environments: Federal agencies, critical infrastructure, enterprises, software producers, telecommunications, transportation, military, cloud, edge, IT and OT systems
Attack Vector(s): Internet-exposed vulnerabilities, unpatched KEVs, vulnerable network services, weak authentication, command and code injection, path traversal, memory corruption, legacy protocols
CISA Action: Published the CISA Vulnerability Review: Fiscal Years 2024 and 2025 on August 26, 2026
Required Response: Prioritize internet-exposed KEVs, reduce attack surface, eliminate recurring software weaknesses, strengthen authentication, replace unsupported systems, and adopt Secure by Design practices

---

The Cybersecurity and Infrastructure Security Agency has released a wide-ranging review of vulnerability data from fiscal years 2024 and 2025, warning that most successful compromises continue to originate from known, preventable software weaknesses rather than sophisticated zero-day attacks.

CISA said opportunistic threat actors routinely scan the internet for vulnerable systems, exposed services, unpatched software and weaknesses that have been understood for years. The agency said basic security failures remain one of the most dependable paths into organizations and warned that artificial intelligence is beginning to make discovery and exploitation of those weaknesses faster and easier.

The report establishes a baseline for the vulnerability landscape before AI-enabled vulnerability discovery becomes more widespread and places substantial emphasis on shifting responsibility upstream toward software producers through Secure by Design development.

CISA’s review draws from Common Vulnerabilities and Exposures records, Known Exploited Vulnerabilities, Cyber Hygiene scanning, Risk and Vulnerability Assessments and other vulnerability data collected across fiscal years 2024 and 2025.

---

Vulnerability Trends and Root Causes

CISA found that a relatively small number of recurring weakness classes continue to generate a significant share of exploitable vulnerabilities.

Injection-related weaknesses accounted for 10.1% of all CVEs in FY2024 and 9.2% in FY2025.

Cross-site scripting remained prominent in FY2025, reinforcing CISA’s finding that inadequate input validation continues to create exploitable paths for session hijacking, credential theft, malicious redirects and other forms of code execution.

The problem becomes more significant when CISA looks at vulnerabilities that attackers are already exploiting.

The agency’s Known Exploited Vulnerabilities Catalog shows that memory-safety flaws, injection weaknesses and improper input validation appear disproportionately in real-world attacks.

In FY2024, memory-safety weaknesses represented 19.8% of KEVs, injection weaknesses accounted for 10.1%, and improper input validation represented 8.1%.

In FY2025, seven of the 10 most common CWE categories among KEVs fell into injection, improper input validation or file-handling categories.

CISA’s conclusion is straightforward: threat actors continue to succeed because developers and organizations repeatedly leave the same weakness classes available for exploitation.

---

The Six Weaknesses Driving Compromise

CISA identified six major Common Weakness Enumeration categories that dominate its vulnerability-scanning data and align with 26 MITRE ATT&CK tactics, techniques and procedures.

Those weaknesses are:

• CWE-89 — SQL Injection
• CWE-20 — Improper Input Validation
• CWE-22 — Path Traversal
• CWE-77 — Command Injection
• CWE-94 — Code Injection
• CWE-306 — Missing Authentication for Critical Function

These weaknesses can enable command execution, credential theft, unauthorized file access, malicious code execution and takeover of critical application functions.

The significance is not that these are new attack techniques. Most have been known for years.

CISA found that 41.5% of KEVs across FY2024 and FY2025 map to what MITRE describes as “stubborn weaknesses” — flaws that continue appearing despite years of industry awareness.

Some weakness types still being exploited today would have qualified as “unforgivable vulnerabilities” under MITRE criteria dating back to 2007 because the underlying mistakes are common, documented and relatively easy to exploit.

---

Real-World Assessments Confirm the Pattern

CISA’s Risk and Vulnerability Assessments produced similar findings.

Improper input validation and memory-safety weaknesses remained reliable entry points during FY2024 and FY2025, including within organizations considered more cyber mature.

CISA found that injection weaknesses were less successful against some mature environments, but memory-safety problems and weak validation logic continued creating openings for attackers.

The agency determined that memory safety and improper input validation accounted for 19.7% of KEVs in FY2024 and 16.7% in FY2025.

This is one of the clearest findings in the review: mature cybersecurity programs can reduce exposure, but recurring weaknesses in software development continue to create attack paths before defensive teams ever see the product.

---

CISA Shifts Away From CVSS-Only Prioritization

The review also formalizes a major change in vulnerability management.

CISA said the Common Vulnerability Scoring System alone is not sufficient for determining which vulnerabilities deserve immediate attention because CVSS measures theoretical technical severity without fully accounting for operational context.

Under the framework associated with Binding Operational Directive 26-04, organizations are encouraged to evaluate four factors:

1. Whether the affected asset is publicly exposed.
2. Whether the vulnerability appears in CISA’s KEV Catalog.
3. Whether exploitation can be automated.
4. Whether successful exploitation gives an attacker partial or complete control.

CISA recommends using the Stakeholder-Specific Vulnerability Categorization framework, or SSVC, to convert those factors into operational decisions.

Under SSVC, vulnerabilities can be classified as Track, Track*, Attend or Act.

“Act” represents the highest priority and calls for immediate mitigation and leadership involvement.

During FY2024 and FY2025, CISA designated 520 CVEs for action across critical infrastructure entities using this risk-based approach.

---

KEV Remediation Is Improving — But Still Too Slow

CISA reported progress in how quickly critical infrastructure organizations are addressing known exploited vulnerabilities.

Fewer organizations left KEVs exposed beyond 30 days in FY2025 compared with FY2024.

The agency still found that most organizations were failing to meet recommended remediation timelines.

Every additional day that a known exploited vulnerability remains exposed gives attackers more time to scan for it, weaponize it and establish access.

CISA advises organizations to treat internet-exposed KEVs as immediate-response vulnerabilities and investigate affected systems for indicators of compromise rather than assuming patching alone resolves the risk.

---

Exposed Services Remain an Open Door

The report also identifies vulnerable network services as one of the simplest paths into critical infrastructure.

CISA found that 26% of critical infrastructure entities scanned during FY2024 and FY2025 exposed vulnerable network services.

Approximately 18% were running FTP servers.

FTP remains problematic because it lacks modern encryption and strong authentication, exposing credentials and increasing opportunities for malware deployment or unauthorized access.

CISA also highlighted Remote Desktop Protocol, Server Message Block and Telnet as high-risk services frequently targeted by attackers.

Internet-exposed RDP remains a recurring entry point for ransomware operations.

SMB vulnerabilities continue to support malware propagation and privilege escalation.

Telnet remains present in legacy and IoT environments despite lacking encryption and modern authentication controls.

---

Legacy Infrastructure Is Expanding the Attack Surface

CISA’s scanning data identified another serious problem: organizations continue operating software and protocols that can no longer be adequately secured.

The agency found that 51% of scanned entities were running unsupported software associated with more than half of KEVs.

It also found that 91% relied on deprecated SSL or TLS protocols, with those exposures remaining unresolved for a median of 459 days.

Unsupported edge devices present a particularly serious risk because once vendor support ends, newly discovered vulnerabilities may never receive patches.

CISA has already directed federal agencies through Binding Operational Directive 26-02 to remove unsupported edge devices from federal networks.

---

AI Is Accelerating Exploitation

CISA warns that artificial intelligence is changing how quickly attackers can identify and exploit vulnerable systems.

Threat actors can use AI to automate phishing, locate vulnerable software, scale reconnaissance and shorten portions of the exploitation process.

The agency recommends treating AI deployments as high-risk enterprise software and applying the same Secure by Design expectations used elsewhere across critical infrastructure.

CISA specifically recommends stronger multifactor authentication, elimination of entire vulnerability classes and resilient engineering for systems integrating AI.

The concern is not that AI suddenly creates every attack path from nothing. It can make old attack paths cheaper, faster and easier to scale.

That makes long-standing weaknesses more dangerous rather than less relevant.

---

Salt Typhoon Shows the Cost of Unpatched Vulnerabilities

One of CISA’s case studies examines the Chinese government-sponsored threat actor commonly known as Salt Typhoon.

According to the review, the group has conducted a global surveillance campaign since at least 2021 by exploiting known and unpatched vulnerabilities in internet-facing network devices.

CISA said the activity affected telecommunications, transportation and military infrastructure and enabled persistent access, long-term cyber espionage and collection of sensitive communications and intelligence.

Edge devices created an additional defensive challenge because they often lack the telemetry and logging available from conventional endpoints.

CISA’s lesson from the case is direct: organizations that fail to remediate Known Exploited Vulnerabilities give sophisticated threat actors a predictable route into strategically important networks.

---

Secure by Design

CISA argues that cybersecurity responsibility must move closer to software producers.

Instead of forcing customers to constantly patch insecure products, vendors should eliminate recurring vulnerability classes during design and development.

CISA recommends that software producers automate secure configuration and updates, embed security throughout the development lifecycle, eliminate common weakness classes and publish roadmaps for vulnerabilities that cannot yet be completely removed.

The agency also encourages customers to apply Secure by Demand principles when purchasing software.

Organizations should evaluate whether products provide automatic security updates, phishing-resistant authentication, MFA without additional cost, elimination of default passwords, adequate security logging and documented plans for eliminating known weakness classes.

---

Defensive Guidance

Organizations should prioritize a small number of high-impact actions:

• Patch internet-exposed KEVs immediately and investigate for compromise.
• Remove or isolate unsupported and end-of-support systems.
• Disable unnecessary FTP, Telnet, RDP and SMB exposure.
• Enforce strong authentication and MFA.
• Reduce reliance on memory-unsafe development where practical.
• Require strict input validation and parameterized queries.
• Segment critical systems and edge infrastructure.
• Use SBOMs and strengthen software-supply-chain visibility.
• Apply CISA’s Cybersecurity Performance Goals 2.0 across IT and OT environments.
• Evaluate vendors based on Secure by Design and Secure by Demand practices.

CISA designed its Cybersecurity Performance Goals around six functions aligned with the NIST Cybersecurity Framework: Govern, Identify, Protect, Detect, Respond and Recover. The agency describes the CPGs as a minimum set of practical, high-impact cybersecurity measures for organizations with limited resources.

---

30-Day Outlook

The immediate risk is unlikely to come from a new vulnerability class.

It will come from organizations continuing to expose known weaknesses that attackers already understand how to exploit.

Internet-facing KEVs, unsupported edge devices, weak authentication, injection flaws and vulnerable legacy services remain predictable targets.

AI-assisted discovery will place additional pressure on vulnerability-management teams because attackers will be able to identify exposed systems faster and automate portions of reconnaissance and exploitation.

Organizations that continue treating every CVE as equally important will struggle under that volume.

The more effective approach is CISA’s risk-based model: determine what is exposed, what is already being exploited, what can be automated and what gives attackers meaningful control.

---

TRJ Verdict

CISA’s FY2024 and FY2025 review makes one fact difficult to ignore: much of the cybersecurity problem is not being created by unknown vulnerabilities.

It is being sustained by known weaknesses that organizations and software producers have failed to eliminate.

Attackers continue returning to the same doors because those doors remain open.

Improper input validation, memory-safety failures, command injection, path traversal, weak authentication, exposed services and unsupported software have been documented for years. They continue appearing in modern products and continue being exploited in real-world attacks.

Artificial intelligence raises the stakes because it can accelerate discovery and exploitation of those weaknesses at scale.

The defensive answer is not endless emergency patching after attackers move first.

Software producers must remove predictable weakness classes during development, organizations must prioritize vulnerabilities based on actual operational risk, and critical infrastructure operators must stop leaving known exploitable systems exposed to the public internet.

That is the central warning running through CISA’s review: the next major compromise may not require a breakthrough exploit. It may require nothing more than an old weakness left unattended.

---

---

Cybersecurity and Infrastructure Security Agency (CISA), CISA Vulnerability Review — Fiscal Years 2024 and 2025, published August 2026. (Free Download)

---

---

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---