CISA's Vulnerability Report Is a Masterclass in Déjà Vu
CISA has published its latest vulnerability review, and the headline finding is as depressing as it is predictable: the bugs doing the most damage in 2024 and 2025 are the same ones security professionals have been screaming about for twenty years.
The agency combed through CVE records and its Known Exploited Vulnerability catalog and found that injection flaws dominate. SQL injection, OS command injection, cross-site scripting. These are not exotic zero-days. They are the embarrassing basics. Improper input validation took the top spot overall, ranking as the single most common weakness across both the CVE list and the KEV catalog.
For context: MITRE published a paper in 2007 categorising certain vulnerability classes as "unforgivable." The criteria were simple enough. The mistake is well-documented. The attack path is obvious. Exploitation requires minimal skill. An attacker can find the bug in minutes. In 2025, three of CISA's top ten CWEs still meet that definition. Three more fall into MITRE's 2023 "stubborn weaknesses" category.
Seven of the ten most frequent CWEs in the KEV catalog are stubborn weaknesses. They account for 41.5 percent of everything on that list. The top three KEV weakness types are improper input validation, path traversal, and OS command injection. Unforgivable, stubborn, and apparently unkillable.
CISA's own penetration tests, carried out against real US organisations at no cost, confirm the picture. Memory safety issues and input validation failures are consistently the most reliable routes to compromise. Injection flaws show up frequently in CVE data too, though they tend to be less effective against organisations that have their act together.
The agency is not mincing words about where the blame lies. "The problem is not technical complexity," it states. "It is organisational culture, developer workflows, and systemic gaps in Secure by Design adoption." In other words, the industry knows how to fix this. It just hasn't bothered.
The Secure by Design pitch is not new either. CISA has been pushing it for years. The core argument is straightforward: vendors should stop treating security as someone else's problem and build it in from the start. Ship responsible software rather than quarterly patch mountains that grow larger with every release cycle.
Practically speaking, CISA wants vendors to take ownership of security outcomes, eliminate these well-catalogued weakness classes at source, and automate the tedious configuration and update tasks that defenders currently have to handle manually. On the buyer side, organisations should be selecting vendors that can demonstrate genuine Secure by Design commitments and maintaining software bills of materials to keep a grip on supply chain risk.
None of this is technically hard. That is the point. The vulnerabilities persisting at the top of these lists are not persisting because they are difficult to prevent. They are persisting because fixing them requires someone to actually prioritise it, and too many vendors have calculated that patching after the fact is cheaper than building it right the first time.
That calculation looks increasingly questionable when your customers keep appearing in breach headlines.