As cited
Copy frozen at (site build).
vulnerabilities
CISA: Most exploited vulnerabilities should have been eradicated decades ago
CISA's analysis of vulnerabilities exploited in 2024 and 2025 found that the most frequently targeted flaws are decades-old, preventable weaknesses such as injection attacks (CWE-78, CWE-79, CWE-89), improper input validation (CWE-20), and path traversal (CWE-22). Seven of the top ten most common weakness types in the Known Exploited Vulnerability (KEV) catalog were classified as 'stubborn weaknesses' by MITRE in 2023, and three belonged to 'unforgivable' vulnerabilities identified in 2007. CISA attributes the persistence of these issues to organizational culture and incomplete adoption of Secure by Design practices rather than technical complexity, and urges vendors to build secure software and buyers to demand SBOMs and accountability.
Why it matters: Practitioners should prioritize patching input validation, injection, and path traversal flaws in their environments, and procurement teams should evaluate vendors on Secure by Design commitment and SBOM transparency, as these fundamental weaknesses remain the most reliable exploitation vectors attackers use today.
- Source published
- First seen by Cybersecurity Tracker