CISA published a vulnerability review on 28 August 2026 covering 2024 and 2025. Its conclusion is not that attackers have got cleverer.

Three of today's ten most frequent weakness types would have been classed as unforgivable by MITRE's standard from 2007.

What is actually being exploited

Not novel memory corruption. Not exotic cryptographic failures. This:

  • Improper input validation (CWE-20) — the single most common weakness across both the KEV catalog and CVEs generally
  • Injection: cross-site scripting (CWE-79), OS command injection (CWE-78), SQL injection (CWE-89)
  • Path traversal (CWE-22)

Seven of the ten most frequent weakness types on the Known Exploited Vulnerabilities catalog account for 41.5% of everything on that list. Seven of the ten most frequent in 2024 fall into MITRE's category of stubborn weaknesses. Three of the top five KEV entries came from holes that had simply never been fixed.

Memory safety and improper input validation together make up 16.7% of 2025 KEV entries.

CISA's explanation is about organisations, not engineering

The agency's own words: threat actors continue to succeed, in part, because simple, preventable software weaknesses remain unaddressed.

It attributes their persistence to organisational culture, developer workflows, and systemic gaps in Secure by Design adoption — explicitly not to technical complexity.

That is a stronger claim than it first appears. Nobody is arguing that SQL injection is hard to prevent. Parameterised queries have been the answer for twenty-five years, they are the default in every modern framework, and every developer has been taught them. The persistence is not a knowledge problem. It is that shipping is measured and not shipping this particular bug is not.

This month, in one paragraph

Everything above matched what this site has been writing all month, which is what makes the report worth reading rather than filing.

Kaltura's unvalidated PHP unserialize sat byte-identical across 21 releases from 2015. GiveWP chained an unsafe unserialize helper into command execution. Gitea's code injection was reachable because registration is open by default. ownCloud's authentication bypass, fixed in 2023, took nuclear research records this year.

Deserialisation, injection, an authorisation check that trusts the wrong thing, and a patch nobody applied. Not one of them required anything to be invented.

The uncomfortable implication

If the exploited weaknesses have not changed in two decades, then two decades of security investment has not moved the thing that actually causes breaches.

That does not mean the investment was wasted — the counterfactual is unknowable, and the attack surface grew enormously over the same period. But it does mean that a strategy built around detecting sophisticated attackers is optimising for the minority case. The majority case is a category of bug that was solved before some of the affected developers were born.

What to do

  • Test for the boring things first. Injection, traversal and input validation cover the bulk of what is actually exploited.
  • Make the secure path the default path. Frameworks that make injection hard work; guidance that makes it forbidden does not.
  • Track unfixed holes as a category. Three of the top five KEV entries were flaws that had never been remediated, not new discoveries.
  • Read the report against your own backlog rather than against the threat landscape. The gap is likely to be in the tickets nobody prioritised.

What is not established

  • Which vendors are responsible for the bulk of these. CISA does not name them.
  • Any enforcement mechanism for Secure by Design. There is none proposed.
  • Whether the trend is improving or worsening, as distinct from persisting.
  • How much of the KEV catalog reflects what is exploited versus what is noticed and reported.