CISA warns of persistent software flaws in exploits

The US Cybersecurity and Infrastructure Security Agency has issued a vulnerability review report on exploited software flaws, highlighting long-running weaknesses in software security.

The report examines data from the past two years and finds that 41.5% of known exploited vulnerabilities map to weakness categories described as "unforgivable" nearly two decades ago. These are flaws considered well understood, easy to detect and avoidable during software development.

Among the issues identified are command injection, path traversal and hard-coded credentials. The review also found that six Common Weakness Enumerations map to 26 MITRE ATT&CK techniques, suggesting that a relatively small set of root-cause problems continues to create broad openings for attackers.

Critical infrastructure organisations are patching known exploited vulnerabilities faster than in previous years, but still missing CISA's recommended remediation timelines. The agency's catalogue of known exploited vulnerabilities has now passed 1,484 entries.

Data in the report shows that additions to the catalogue in 2025 were about 20% above the prior two-year trend. Roughly one in five listed vulnerabilities has been linked to ransomware activity, underlining the role of older software weaknesses in current attacks.

Persistent flaws

The findings point to two broad technical groups that recur in real-world compromises. One is injection-related flaws, including operating system command injection, code injection and deserialisation of untrusted data.

The other centres on memory safety problems, including use-after-free issues, out-of-bounds writes and heap overflows. Missing authentication checks and path traversal also feature prominently in the exploited set.

Sachin Kode, head of security at ArmourCode, said the figures show the industry is failing to eliminate weaknesses that have been understood for years.

"41.5% of KEVs mapping to CWEs considered 'unforgivable' two decades ago should be uncomfortable for the industry. This is not a knowledge gap. We know how to prevent command injection, path traversal and hard-coded credentials. It is an incentive and execution gap.

"Software keeps shipping with weaknesses we solved conceptually a long time ago because speed to market and feature pressure still win over eliminating root causes. The hard part was never identifying these bugs. It is getting organisations to design them out and fix them before they reach production.

"The report is essentially a snapshot of the vulnerability landscape taken right before AI-assisted vulnerability discovery becomes routine for both attackers and defenders. That timing matters. If adversaries start finding and weaponising flaws faster with automation, the classes of weakness we already fail to prevent will be exploited at higher volume and speed.

"The KEV data also stands out. The catalogue crossed 1,484 known exploited vulnerabilities, and 2025 additions jumped about 20% over the prior two-year trend. Roughly one in five of those flaws has been tied to ransomware activity. Exploitation is not slowing down, and attackers are still getting mileage out of vulnerabilities we have understood for years.

"Two of the top CWE categories driving compromise stand out. One is injection, led by OS command injection, code injection and deserialisation of untrusted data. The other is memory safety, including use-after-free, out-of-bounds writes and heap overflows. Missing authentication and path traversal round out the list.

"What jumps out is that the weaknesses attackers exploit in the wild are not always the ones researchers report most often. In the KEV set, memory safety and command injection rank much higher than they do on the general Top 25. In plain terms, attackers gravitate toward weaknesses that give them code execution or full system takeover. Cross-site scripting is everywhere in disclosure data, but sits near the bottom of what is actually exploited for compromise.

"For defenders, the takeaway is practical: prioritise by what is being exploited and by impact, not by raw vulnerability counts. The memory safety cluster also strengthens the case for memory-safe languages in new development, since those flaws persist decades after they were identified and continue to give attackers reliable exploitation paths.

"Based on the top CWEs, it is obvious that organisations need to prioritise real-world exploitation using intelligence such as the KEV catalogue and actual business context, rather than treating a CVSS score as the whole story. A high-scoring bug that nobody is exploiting can wait behind a medium-scoring one that ransomware crews are hitting today.

"Know what you own. Most slow remediation traces back to poor asset and software inventory, which means teams cannot quickly answer 'are we affected and where?' Fixing that visibility problem shortens every response that follows.

"Reduce the manual handoffs between finding a flaw and someone actually patching it. The delay is rarely the patch itself. It is the triage, the ownership questions and the routing. Automating that path and pushing prioritised, deduplicated work directly to the teams that own the fix is where speed comes from.

"Push work left. Root-cause mapping and secure-by-design practices stop the same weakness classes from being reintroduced release after release, which lowers the remediation load over time instead of only clearing today's queue.

"The report puts hard numbers behind advice the community has given for years and shows that the guidance is still not being followed at scale, since half of exploited flaws are preventable weakness classes. We need to get the fundamentals right now, because the window to do so before automated exploitation raises the stakes is closing."

Exploitation trends

The report adds to a wider debate in cybersecurity over whether organisations are prioritising the right vulnerabilities. A longstanding criticism of software patching programmes is that they often focus on volume and severity scores rather than evidence of active exploitation.

That is one of the review's clearest messages. The exploited vulnerability list differs in important ways from broader disclosure rankings, with memory safety issues and command injection appearing more often in incidents than in many general vulnerability counts.

The contrast matters because it points defenders toward the flaws most likely to lead to code execution or full system compromise. It also suggests that some highly visible bug classes, such as cross-site scripting, may receive disproportionate attention compared with weaknesses that attackers use more often to gain control of systems.

The review also reinforces the operational challenge facing infrastructure operators and large enterprises. Even where patching times are improving, the gap between discovery, triage, ownership and deployment remains large enough for exploited flaws to persist in production environments beyond recommended deadlines.

That leaves software inventory, asset visibility and remediation workflows at the centre of vulnerability management. The data suggests the problem is not only the existence of known classes of software weakness, but the repeated failure to remove them from products before release and to fix them quickly once exploitation is identified.

The finding that six Common Weakness Enumerations map to 26 MITRE ATT&CK techniques also points to a concentrated problem set. Rather than a sprawling universe of unrelated bugs, the review suggests attackers continue to benefit from a narrower collection of recurring implementation and design failures.

For software makers, that raises questions about secure-by-design practices and the incentives shaping release cycles. For defenders, it sharpens the case for using threat intelligence and business context when deciding which systems to patch first.

"We need to get the fundamentals right now, because the window to do so before automated exploitation raises the stakes is closing," Kode said.