CISA review makes the case for eliminating vulnerability classes
CISA's FY2024-2025 vulnerability review urges eliminating recurring vulnerability classes, finding 41.5% of 2025 KEV entries map to persistent 'stubborn weaknesses'.
CISA's Vulnerability Review for fiscal years 2024 and 2025 found most compromises stemmed from opportunistic exploitation of known, exposed vulnerabilities rather than nation-state zero-days or advanced tradecraft. The review found 41.5% of 2025 KEV catalog entries map to 'stubborn weaknesses' - injection flaws, improper input validation, memory-safety failures, path traversal and broken access control - recurring on the CWE Top 25 since 2019. CISA advocates Secure by Design practices, vulnerability class elimination, and buyer-driven 'Secure by Demand' contract requirements, while warning that AI-enabled vulnerability discovery will soon accelerate exploitation.
- Most compromises exploited known, exposed vulnerabilities, not nation-state zero-days or advanced tradecraft.
- 41.5% of 2025 KEV entries map to weakness classes recurring on the CWE Top 25 since 2019.
- Verizon's 2026 DBIR found vulnerability exploitation is now the most common initial access vector.
- CISA's Secure by Demand urges buyers to require eliminated vulnerability classes and machine-readable SBOMs.
- Eliminating memory-safety flaws often requires costly multi-year rewrites of C/C++ codebases.
- Countries
- US
From the original article
3 min read at helpnetsecurity.com
For years, the security industry has treated vulnerabilities as an endless queue of individual fixes. A recent CISA review argues that this is precisely why attackers keep winning. The solution to this problem, they believe, is eliminating entire categories of weaknesses at the source.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.