CISA: Decades-Old Security Flaws Remain Top Exploitation Targets
Software vendors still fail to implement basic security measures, making cyber attacks easier.
1Legacy Vulnerabilities Still Active
CISA's 2024-2025 data shows most exploited vulnerabilities are from well-known decades-old categories. SQL injection (CWE-89), OS command injection (CWE-78), and XSS (CWE-79) top both CVE lists and the KEV catalog. CISA emphasizes these flaws could be prevented with basic security standards, but software vendors consistently fail to implement them.
2MITRE Reports Correlation
Security issues labeled 'unforgivable vulnerabilities' in 2007 and 'stubborn weaknesses' in 2023 still dominate exploit statistics in 2025. Seven of the top 10 CVEs in 2024 and seven of KEV's top 10 (41.5% of all entries) fall into these categories. Improper input validation (CWE-20) remains particularly prevalent, demonstrating the industry's failure to learn fundamental lessons.
3Real-World Impacts
CISA's Risk and Vulnerability Assessments (RVAs) confirm memory safety and input validation flaws as the most reliable exploitation paths, constituting 16.7% of 2025 KEV entries. While cyber-mature organizations are less affected by injection flaws, these basic errors continue to weaken overall security postures across industries.
4Cultural Problem in Tech
CISA stresses the issue stems from organizational culture and developer workflows, not technical complexity. The persistence of vulnerabilities deemed 'unforgivable' 19 years ago indicates need for radical priority shifts. Lack of Secure by Design (SBD) adoption perpetuates recurring security failures in software development lifecycles.
5Proposed Solutions
CISA urges software vendors to 'own security outcomes' by eliminating stubborn weaknesses and improving automated configuration/monitoring systems. Buyers should prefer vendors meeting SBD standards and providing SBOMs (Software Bills of Materials). The agency calls for fundamental redesigns rather than reliance on growing patch packages.
6Limits of Patch Culture
CISA advocates secure initial design over record-breaking patch releases. 2025 data proves reactive security measures fail long-term; responsibility must shift to vendors reducing defenders' burdens. The report highlights how patch-dependent strategies enable continuous exploitation of preventable flaws.
7Leadership Call to Action
CISA frames cyber risk as business risk, national security threat, and operational resilience blocker. Cross-industry collaboration and vulnerability prioritization are critical. Executives must drive cultural transformation embedding security throughout product lifecycles rather than treating it as add-on feature.
8Future Warning
Data indicates the same security mistakes will fuel exploits for the next decade without SBD adoption. While attack complexity increases, foundational vulnerabilities remain unchanged. CISA's message is clear: Advanced security measures are meaningless without fixing fundamental design flaws first.