# CISA: Decades-Old Security Flaws Remain Top Exploitation Targets Software vendors still fail to implement basic security measures, making cyber attacks easier. - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-08-28 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/f34177e0-1e54-494c-8e61-502e88d46a12 ## Legacy Vulnerabilities Still Active CISA's 2024-2025 data shows most exploited vulnerabilities are from well-known decades-old categories. SQL injection (CWE-89), OS command injection (CWE-78), and XSS (CWE-79) top both CVE lists and the KEV catalog. CISA emphasizes these flaws could be prevented with basic security standards, but software vendors consistently fail to implement them. ## MITRE Reports Correlation Security issues labeled 'unforgivable vulnerabilities' in 2007 and 'stubborn weaknesses' in 2023 still dominate exploit statistics in 2025. Seven of the top 10 CVEs in 2024 and seven of KEV's top 10 (41.5% of all entries) fall into these categories. Improper input validation (CWE-20) remains particularly prevalent, demonstrating the industry's failure to learn fundamental lessons. ## Real-World Impacts CISA's Risk and Vulnerability Assessments (RVAs) confirm memory safety and input validation flaws as the most reliable exploitation paths, constituting 16.7% of 2025 KEV entries. While cyber-mature organizations are less affected by injection flaws, these basic errors continue to weaken overall security postures across industries. ## Cultural Problem in Tech CISA stresses the issue stems from organizational culture and developer workflows, not technical complexity. The persistence of vulnerabilities deemed 'unforgivable' 19 years ago indicates need for radical priority shifts. Lack of Secure by Design (SBD) adoption perpetuates recurring security failures in software development lifecycles. ## Proposed Solutions CISA urges software vendors to 'own security outcomes' by eliminating stubborn weaknesses and improving automated configuration/monitoring systems. Buyers should prefer vendors meeting SBD standards and providing SBOMs (Software Bills of Materials). The agency calls for fundamental redesigns rather than reliance on growing patch packages. ## Limits of Patch Culture CISA advocates secure initial design over record-breaking patch releases. 2025 data proves reactive security measures fail long-term; responsibility must shift to vendors reducing defenders' burdens. The report highlights how patch-dependent strategies enable continuous exploitation of preventable flaws. ## Leadership Call to Action CISA frames cyber risk as business risk, national security threat, and operational resilience blocker. Cross-industry collaboration and vulnerability prioritization are critical. Executives must drive cultural transformation embedding security throughout product lifecycles rather than treating it as add-on feature. ## Future Warning Data indicates the same security mistakes will fuel exploits for the next decade without SBD adoption. While attack complexity increases, foundational vulnerabilities remain unchanged. CISA's message is clear: Advanced security measures are meaningless without fixing fundamental design flaws first. ## Sources covering this story - https://www.theregister.com/security/2026/08/28/cisa-most-exploited-vulnerabilities-should-have-been-eradicated-decades-ago/5293194 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._