CISA's Annual Review: Most Exploited Flaws 'Should Have Been Eradicated Decades Ago'

CISA published its Vulnerability Review on 2026-08-26, covering fiscal years 2024 and 2025 (the full PDF is 3.4 MB of "you already knew this"). The headline is The Register's line from today: most exploited vulnerabilities "should have been eradicated decades ago".

If you run a homelab and your router firmware is three versions behind, you already concluded this. Now it has a citation.

The numbers//

• Injection is still the big sport. Cross-site scripting (CWE-79), OS command injection (CWE-78), and SQL injection (CWE-89) were among the most common weaknesses across both CVE records and KEV catalog entries in 2024 and 2025.
• CWE-20 (improper input validation) is the single most common weakness type in the KEV catalog and in registered CVEs. The "validate your input" lecture from every code review ever written is the number-one weakness type in the catalog of known-exploited vulnerabilities.
• 2024: seven of the ten most frequent CWEs on the CVE list belong to MITRE's "stubborn weaknesses" (their 2023 list). The same ratio on the KEV side — and those seven classes account for 41.5% of all bugs in that catalog. Three of the top five KEV entries trace back to flaws MITRE called "unforgivable" back in 2007: improper input validation (CWE-20), path traversal (CWE-22), and OS command injection (CWE-78).
• 2025: same pattern. Seven of the top-ten CWEs are still the ones that would have been "unforgivable" nearly two decades ago.
• Where exploitation actually comes from: CISA's Risk and Vulnerability Assessments (RVAs) — the no-cost pen tests they run on real organizations — found that memory safety and improper input validation are the most reliable paths to exploitation. The Register cites 16.7% of 2025 KEV entries for that pairing.

CISA's own words on the 2025 list:

"Three of today's top 10 CWEs would have been considered 'unforgivable' nearly two decades ago. Their persistence today illustrates that the problem is not technical complexity: it is organizational culture, developer workflows, and systemic gaps in Secure by Design adoption."

"Stubborn" and "unforgivable" in one breath//

MITRE published its "unforgivable vulnerabilities" list in 2007 — flaws that exist because of common, well-documented mistakes, have an "obvious" attack path, exploit simply, and can be found in minutes. In 2023 it repackaged the same idea as "stubborn weaknesses". Twenty years after the first list, this review shows the lists still match what actually gets exploited. The bug classes didn't change. The organizations keeping the same bugs did not change either.

What CISA is asking for//

1. Secure by Design — vendors should "own security outcomes" instead of shipping a bug list and a patch package and calling it a day.
2. Kill the stubborn classes — stop shipping code with CWE-20/22/78/79/89 in production.
3. SBOMs — software buyers should only pick vendors who can prove what's in the box, and use the SBOM to track supply-chain risk.
4. Automate configuration, monitoring, and updates — "reacting to threat actors" is the failure mode; fix the fundamental flaw instead.

And for people who still have to patch things: the review leans on the BOD 26-04 prioritization framework — exposure status, KEV catalog status, automated-exploitation potential, technical impact — to decide what to fix first. If you want it in detection-engineer language, cyfar's writeup breaks it down.

What to do tonight//

1. Pull the KEV catalog — it's a JSON feed you can join against your asset list — and mark anything that appears in both. Internet-exposed plus KEV-listed is BOD 26-04's first-priority population, and it's exactly the population this review says gets hit.
2. Read the weakness class, not just the CVE. If a bug is in the injection / input-validation family, assume the same class exists in your other apps. Patching one instance of a class is a band-aid; reducing exposure is the treatment.
3. Inventory what's exposed. The review's core finding is that exposed + unpatched + old-class is the exploit recipe. You can't fix what you can't see.
4. Don't wait for the patch when the class is the problem. The 41.5% figure means the catalog keeps catching bugs that were knowable in 2007. Some of them get fixed; some of them just get exposed less.