CISA: Most exploited vulnerabilities should have been eradicated decades ago
CISA says many of the software weaknesses most often exploited by attackers are long-established, preventable flaws that vendors should have eliminated decades ago. Its review argues that the persistence of these problems reflects organisational culture, developer workflows and incomplete adoption of Secure by Design practices, rather than technical difficulty.
Across 2024 and 2025, injection flaws including cross-site scripting, operating-system command injection and SQL injection were common in CVE and Known Exploited Vulnerability records. Improper input validation was the most frequent weakness, while seven of the ten most common KEV weakness types in 2024 were MITRE’s “stubborn weaknesses”, representing 41.5% of that catalogue; CISA also highlighted path traversal and command injection as leading routes to real-world exploitation. The agency urged vendors to take responsibility for security outcomes by preventing these defect classes during development instead of relying on ever-larger patch releases.
- CISA says preventable flaws still drive many cyberattacks.
- Input validation and injection bugs remain especially significant.
- Secure by Design adoption is the proposed remedy.
New here? Start with this
CISA is the US agency responsible for helping protect the country’s computer systems and critical infrastructure. It tracks software vulnerabilities, which are weaknesses attackers can use to break into systems or disrupt services.
Some common vulnerabilities arise when software handles information it receives from users or other systems in unsafe ways. These flaws can affect many kinds of software, and attackers may use them to access data or run commands without permission.
CISA’s Secure by Design approach asks software makers to build security into products from the start. The issue matters because weaknesses that persist across products can leave organisations and the public exposed, even as vendors release patches to fix individual problems.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
CISA’s argument is that recurring injection and input-validation flaws are well understood and can often be prevented through safer defaults, secure development practices and better testing. Because attackers repeatedly exploit them, vendors should take greater responsibility for preventing these defects at source rather than leaving customers to manage a growing stream of patches.
The case against
A reasonable counterpoint is that eliminating long-standing flaw types across complex products is difficult: legacy code, compatibility demands, varied deployment environments and pressure to deliver features can make prevention costly and imperfect. Vendors may argue that continuous patching, testing and disclosure are practical parts of security, and that CISA’s catalogue shows which weaknesses are exploited, not by itself how readily every one could have been eradicated decades ago.