CISA’s Known Exploits Still Come From 2007-Era Bugs

CISA’s August 2026 review of fiscal 2024 and 2025 finds 41.5% of known exploited bugs still map to MITRE’s stubborn weakness classes. The Cybersecurity and Infrastructure Security Agency published the two-year vulnerability review on August 26, 2026, and it reads less like a progress report than a rerun.

The same agency now lists hundreds of firms on a voluntary Secure by Design pledge, and its Known Exploited Vulnerabilities catalog grew 20% in 2025. The mix of bugs inside that catalog barely moved.

The Catalog That Still Looks Like 2007

CISA said opportunistic criminals scanning the internet for exposed, well-known software holes, not nation-state zero-days, drove most of the activity it reviewed. Insecure software is still the norm, the agency wrote, and basic security failures still enable most compromises. Artificial intelligence, it added, is already being used to automate the steps needed to exploit those holes.

On the 2024 CVE pile, seven of the ten most frequent Common Weakness Enumeration types were what MITRE calls stubborn weaknesses. Those seven were cross-site scripting (CWE-79), SQL injection (CWE-89), use after free (CWE-416), cross-site request forgery (CWE-352), improper input validation (CWE-20), out-of-bounds read (CWE-125), and path traversal (CWE-22). CISA said that stubborn group accounted for 5% of all CVEs, and that the full top ten accounted for 5.9%, a reminder that many records still lack a CWE tag.

The exploited list is tighter. Seven of the ten most common CWE types on the KEV catalog in 2024 were also stubborn weaknesses, and CISA said they made up 41.5% of all KEVs. Three of those types sat in the top five exploited classes: improper input validation, path traversal, and OS command injection (CWE-78). Across both fiscal years, CISA repeated the same 41.5% stubborn share and called it proof that injection, input handling, memory safety, and file access have not left the building.

STUBBORN WEAKNESSES ON THE 2024 EXPLOITED LIST

For 2025, CISA said seven of the top ten CWE types were still the ones MITRE treated as unforgivable in 2007. The five it named in its own dataset were OS command injection, SQL injection, improper input validation, out-of-bounds read, and path traversal. Three of today’s top ten CWE types, the agency wrote, would have been called unforgivable nearly two decades ago.

Injection Floods the CVE List While Memory Bugs Break In

The disclosure list and the break-in list do not match. CISA said the top ten CWE types on the KEV catalog do not mirror the broader CVE set. Exploited bugs cluster around a smaller group of high-impact types that give attackers a repeatable path.

Injection still dominates paperwork. In FY2024, two of the top ten CVE CWE types were injection flaws, and injection-related weaknesses made up 10.1% of all CVEs. In FY2025, XSS again led the top ten, and injection overall was 9.2% of all CVEs. CISA’s own field work tells a different operational story. Injection shows up constantly in registered CVEs, the review said, and it rarely works against cyber-mature networks.

CVE VOLUME VERSUS REAL BREAK-INS

• Injection share: 10.1% of all CVEs in FY2024 and 9.2% in FY2025, still a large slice of what gets numbered.
• Reliable KEV path: Memory safety plus improper input validation accounted for 19.7% of KEVs in FY2024 and 16.7% in FY2025.
• RVA pattern: CISA’s no-cost penetration tests kept finding CWE-20 and memory-safety holes as the most reliable way into assessed networks.
• MITRE KEV ranking: MITRE’s 2025 ranking of exploited weakness types, updated January 27, 2026, put OS command injection first, with 20 KEV CVEs, ahead of use after free and out-of-bounds write.

Memory safety is not evenly improving, CISA found. Cyber-mature shops show some progress. Less mature shops lag. Improper input validation, most often tagged CWE-20, stayed the single most common weakness type across both the KEV catalog and registered CVEs. That class is a wide bucket, which is part of why it never leaves the leaderboard, and part of why a sermon about “just validate input” has lasted 19 years.

What MITRE Called Unforgivable in 2007

Steve Christey, then at The MITRE Corporation, wrote the 2007 paper on unforgivable vulnerabilities as a canary test, not a research puzzle. If a product still fell to the most obvious attack on its most used feature, he argued, the customer was sitting on a ticking time bomb and the maker had not treated security as a design job.

His “Lucky 13” list opened with buffer overflows from long strings of A characters in logins and file names, XSS via SCRIPT tags, SQL injection using a single quote in a username or id field, remote file inclusion, and directory traversal with../ in GET or SEND commands. Those are the same families CISA is still counting. Hard-coded passwords, world-writable files, and grow-your-own crypto rounded out a list that was already meant to shame vendors out of Phase 1 of a product’s bug history.

THE 2007 TEST FOR AN UNFORGIVABLE BUG

• Precedence: Plenty of other developers, including well-known vendors, had already made the same mistake in public.
• Documentation: Books, papers, and free write-ups described the mistake, so a developer who cared could find the warning quickly.
• Obviousness: The attack jumped out as soon as someone thought about how the feature could be abused.
• Attack simplicity: The exploit used the most common trick for that class, such as a long string of A characters for a buffer overflow.
• Found in five: A tester could locate the issue in about five minutes of limited manual testing or code review.

Christey wrote that these holes “are beacons of a systematic disregard for secure development practices” and “simply should not appear in software that has been designed, developed, and tested with security in mind.” CISA now says the persistence of those classes is not technical complexity. It is organizational culture, developer workflows, and gaps in Secure by Design adoption. That is the same diagnosis with newer stationery.

379 Pledge Signers and a Mix That Would Not Budge

CISA launched the Secure by Design pledge as a voluntary, one-year good-faith effort for enterprise software makers, covering on-prem products, cloud services, and SaaS. The agency’s signers page currently lists 379 companies on the pledge, including Microsoft, Google, Cisco, Amazon Web Services, IBM, Fortinet, CrowdStrike, and GitHub. The first cohort, in 2024, already included several of the names that keep showing up when ransomware groups pick a bug.

A pledge of that size is supposed to change the CWE mix. CISA’s own two-year cut says it has not. The catalog of exploited bugs grew while the classes inside it stayed familiar. SecurityWeek, citing Cyble’s tally in January 2026, reported that CISA added 245 KEVs in 2025, lifting the public catalog 20% to 1,484 entries, with 24 of those additions tagged as ransomware-used, including new Fortinet, Ivanti, and Microsoft holes.

Fortinet, an early signer, posted a progress note on August 26, 2026, the same day as CISA’s review, and said automatic updates had reached more than 1.8 million FortiGate devices since May 2024. That is real engineering work on one pledge goal, patch uptake. It does not retire command injection, path traversal, or CWE-20. In January 2026, Chester Wisniewski, director of global field CISO at Sophos and an inaugural signer, told Channel Holic he had not heard from his Secure by Design contacts that calendar year and that “CISA’s not focusing on this anymore.” Eight months later the agency published a full review that again names Secure by Design as the fix, which is focus of a kind, and still not a change in the exploited mix.

HOW THE SAME WARNING KEPT RETURNING

1. August 2, 2007: Christey publishes the unforgivable-vulnerabilities paper and the Lucky 13 list.
2. November 2021: CISA opens the public Known Exploited Vulnerabilities catalog.
3. 2023: MITRE’s stubborn-weaknesses work, which CISA now uses as a measuring stick, flags the classes that refuse to leave the top ten.
4. May 2024: The Secure by Design pledge starts; large vendors begin signing.
5. August 26, 2026: CISA’s FY2024-25 vulnerability review finds seven of ten top CWE types still in that old set, and 41.5% of KEVs still mapped to stubborn weaknesses.

The federal list that was meant to force action has become a reliable map of which 2007 mistakes still work. Growing the list without killing the classes gives defenders more tickets and attackers the same playbook.

Britain’s Cyber Agency Draws the Same Line

The UK National Cyber Security Centre published a method for scoring unforgivable bugs around the same week, extending Christey’s idea rather than retiring it. Most of the original 13, the NCSC wrote, still exist in one form or another. Vulnerabilities with easy mitigations are the ones it wants declared unforgivable, and it scored those mitigations on cost, how widely they are known, and whether they are technically feasible if they are built in from the start rather than bolted on later.

The British paper is blunter about why the classes survive. Coverity’s 2019 snapshot put average industry defect density at about 1 defect per thousand lines of code, in line with older counts that never really fell. Hatton and colleagues found source code in systems doubles about every 3.5 years because users want more features. If the defect rate stays flat and the code base doubles, the raw count of holes rises even when a vendor is not getting sloppier. That is a volume problem wearing a morality label.

CISA still talks as if organizational culture is the whole story. The NCSC numbers say culture sits on top of a market that ships more code every year and still prices speed ahead of class-level kills. Language choice, safer libraries, and sandboxes are the hard levers for memory bugs and command injection. A voluntary pledge does not flip those levers by itself.

The Average $3.7 Million Ransomware Invoice

CISA sponsored the Cyentia Institute’s IRIS ransomware report and used it to put a price on the lazy path. Ransomware alone, that report said, costs organizations an average of $3.7 million per incident, and firms have a 10% chance of being hit in a given year. The review’s opening claim is that most of those incidents do not need a brilliant exploit. They need an exposed, well-known hole.

That is why the 16.7% KEV share for memory safety and bad input handling is the operational number, and the 9.2% injection share of CVEs is the noise. Patch teams drown in XSS and SQL tickets. Attackers keep walking through CWE-20, path traversal, command injection, and memory corruption. MITRE’s 2025 KEV weakness table makes the same point in another format: command injection, use after free, and out-of-bounds write sit at the top, while XSS, which floods CVE counts, ranks lower on the exploited list even after a one-year jump.

CISA wants this two-year cut treated as a baseline before AI-enabled bug hunting is widespread. If models can run Christey’s five-minute tests at scale, the stubborn classes become cheaper to find in every forgotten appliance and every rushed web form. The catalog will get longer. The classes will not need to change for that to happen.

Buyers Keep Paying for Software That Fails the Old Test

Part 1 of the review is aimed at software producers. Part 2 is aimed at the people who still write the checks. CISA tells producers to own security outcomes for customers, kill the stubborn and unforgivable classes, and automate configuration, monitoring, and updates instead of shipping ever-fatter patch packages. It tells buyers to pick vendors that meet those tests and to keep software bills of materials so they can see what they actually installed.

Federal civilian agencies already have to treat KEVs as a deadline, not a suggestion. The August review also points everyone at Binding Operational Directive 26-04, CISA’s risk-based patching rule, and at the agency’s Cybersecurity Performance Goals 2.0. The Product Security Bad Practices guidance, updated in January 2025, already calls it dangerous to ship a critical-infrastructure product that contains a KEV at release, and it tells makers to patch a new KEV at no cost, in no more than 30 days after a component patch is available.

Organizations must shift from reacting to threat actors to fixing the fundamental flaws those actors are known to exploit. Stronger cybersecurity begins with software that is secure by design.

CISA, Vulnerability Review, Fiscal Years 2024 and 2025

Buyers are the group that can make a voluntary pledge expensive to ignore, and they have mostly not done so. The 379 signatures did not move the 2024-2025 mix. The KEV list grew 20% in a year. Christey’s canaries are still in the coal mine, and CISA is still publishing their names.

CISA says it logged these two years as a baseline before AI-enabled bug hunting is widespread. The 2007 paper already treated several of these holes as a five-minute test. Cheaper search will run that five-minute test on a lot more products.

Frequently Asked Questions

What Is CISA’s Known Exploited Vulnerabilities Catalog?

CISA opened the public KEV catalog in November 2021 as a list of CVEs with evidence of in-the-wild use. Federal civilian executive branch agencies must fix catalogued bugs by CISA due dates, and CISA says any internet-exposed KEV should be treated as an emergency, with a hunt for signs the box is already compromised.

What Did MITRE Mean by Unforgivable Vulnerabilities in 2007?

Steve Christey’s paper set a scoring bar, not a vibe. Precedence and documentation were required, and the bug also had to meet at least two of obviousness, simple attack, and a find-in-five-minutes test. He noted that format-string bugs were rare in 2001 and would not have counted then, but by 2007 they did.

What Is the Difference Between a CVE and a CWE?

A CVE is a single tracked hole in a named product. A CWE is the class of mistake that produced it, such as CWE-79 for XSS. CISA says many CVE records still ship without a CWE tag, which is why class-level math on the full CVE pile is messy and why the agency is pushing a Quality Era of complete records.

What Does CISA’s Secure by Design Pledge Cover?

It is voluntary and aimed at enterprise software, including on-prem products, cloud services, and SaaS. Physical IoT and consumer products are out of scope, though CISA says firms may still show work in those areas. Makers join by email, then get a year to show measurable progress or explain why they could not.

How Does CISA Want Organizations to Pick Which Bugs to Fix First?

Binding Operational Directive 26-04 tells federal agencies to rank patches with four tests: whether the asset is exposed, whether the CVE is on the KEV catalog, whether the exploit can be automated, and what the technical impact is. The August review points private firms at the same four tests rather than chasing every new CVE.