CISA Report: Decades-Old Vulnerabilities Still Plague Software, Underscoring Need for Secure by Design
CISA's latest review reveals that common, long-standing vulnerability classes like injection flaws and improper input validation remain the most exploited, highlighting a critical gap in software development practices.
CISA is renewing its call for software vendors to embrace Secure by Design (SBD) principles, as its latest review indicates that the most frequently exploited vulnerabilities are those that have been known for decades. The agency's analysis of vulnerabilities from 2024 and 2025 shows a persistent pattern: flaws that should have been eradicated years ago continue to be the entry points for cyberattacks. This persistent reliance on outdated vulnerability classes underscores a systemic failure in modern software development to prioritize security from the outset.
The review identified injection-related vulnerabilities, including cross-site scripting (XSS), OS command injections, and SQL injections, as some of the most common issues appearing in both CVE and KEV records. Additionally, improper input validation emerged as the single most prevalent weakness type across the KEV catalog and registered CVEs. CISA explicitly stated that "threat actors continue to succeed, in part, because simple, preventable software weaknesses remain unaddressed," emphasizing that fixing these fundamental issues would significantly reduce common compromises.
This finding echoes historical analyses, referencing MITRE reports from 2007 that identified "unforgivable vulnerabilities" and a 2023 report on "stubborn weaknesses." The current data shows a disturbing continuity, with seven of the top 10 most frequent Common Weakness Enumerations (CWEs) in 2024's CVE list falling under MITRE's "stubborn weaknesses" category. Similarly, seven of the top 10 CWEs in the KEV catalog were also stubborn weaknesses, accounting for a substantial 41.5 percent of all bugs listed. The top five KEVs included improper input validation, path traversal, and OS command injections, demonstrating how reliably these old flaws translate into real-world exploitation.
The trend continued into 2025, with seven of the top 10 CWEs still classified as "unforgivable" nearly two decades prior. CISA pointed out that "three of today’s top 10 CWEs would have been considered ‘unforgivable’ nearly two decades ago," attributing their persistence not to technical complexity, but to "organizational culture, developer workflows, and systemic gaps in Secure by Design adoption."
CISA's own Risk and Vulnerability Assessments (RVAs) corroborate these findings. Across 2024, memory safety and improper input validation vulnerabilities were identified as the most reliable paths to exploitation, making up 16.7 percent of KEV entries in 2025. While injection vulnerabilities are common in CVE registrations, they are less frequently exploited in the wild against mature organizations, suggesting that the most impactful and widespread attacks leverage more fundamental coding errors.
To combat this pervasive issue, CISA is strongly advocating for the adoption of Secure by Design practices. The agency urges vendors to eliminate these stubborn and unforgivable vulnerability classes, thereby reducing the burden on end-users and defenders. This involves building software responsibly from the ground up, rather than relying on increasingly large patch packages to fix fundamental flaws.
In CISA's view, owning security outcomes means actively killing off these persistent weaknesses, improving the automation of configurations, monitoring, and updates. The agency also advises software buyers to prioritize vendors who demonstrate these commitments and to ensure the use of Software Bills of Materials (SBOMs) for supply chain risk management. Ultimately, CISA stresses that "organizations must shift from reacting to threat actors to fixing the fundamental flaws those actors are known to exploit."
The agency concludes that stronger cybersecurity hinges on software that is secure by design, requiring prioritization of vulnerabilities, cross-industry and government collaboration, and leadership attention to recognize cyber risk as a business and national security imperative. This proactive approach is essential for enhancing operational resilience and mitigating the ongoing threat posed by these long-standing, yet easily exploitable, software weaknesses.