CISA: your exploited bugs are 2007 problems, still

CISA published its Vulnerability Review today covering 2024 and 2025, and the finding is not a new threat. It is that the bugs actually being exploited in the wild are the same classes the industry named as solved problems almost twenty years ago.

What actually happened

The review ranks weakness types across both the full CVE corpus and the Known Exploited Vulnerabilities catalog. Improper input validation (CWE-20) is the single most common weakness on both lists. The top three KEV entries by weakness class are input validation, path traversal (CWE-22), and OS command injection (CWE-78).

Seven of the ten most frequent CWEs in the KEV catalog fall into MITRE's "stubborn weaknesses" set — the ones that keep reappearing despite known fixes. Those seven account for 41.5% of everything on the list. In the 2025 data, seven of the top ten map to the "unforgivable" vulnerability classes MITRE published back in 2007. Memory safety plus improper input validation alone made up 16.7% of KEV entries in 2025.

For scale: SecurityWeek reports CISA added 245 vulnerabilities to KEV during 2025, pushing the catalog past 1,480 entries — a 20% expansion, its largest three-year growth rate. CISA's recommendation is Secure by Design practices rather than faster patching.

Why CISA's vulnerability review matters for your business

Nobody is getting owned by novel cryptography. They are getting owned because a form field went into a shell command. If your remediation strategy is a monthly patch window, you are treating a design problem as a maintenance problem. Patching handles someone else's code. It does nothing about the query you concatenated last Tuesday.

Path traversal is a file-upload feature. Every business we work with has a customer-facing upload — invoices, product images, W-9s. Path traversal ranked third in the KEV catalog because that pattern is everywhere and the validation is usually a regex someone wrote once. Normalize the path, resolve it, then check it is still inside your directory. In that order.

Secure by Design is a vendor question, not just a code question. You inherit the weakness classes of everything you buy. When you evaluate a SaaS tool or an integration, the useful question is not "are you SOC 2." It is "show me how you handle untrusted input at your boundary." A vendor who cannot answer that has the same 41.5% problem you do.

Sources: CISA Vulnerability Review, The Register, SecurityWeek.