CISA says many of the software weaknesses most often exploited by attackers are long-established, preventable flaws that vendors should have eliminated decades ago. Its review argues that the persistence of these problems reflects organisational culture, developer workflows and incomplete adoption of Secure by Design practices, rather than technical difficulty.

Across 2024 and 2025, injection flaws including cross-site scripting, operating-system command injection and SQL injection were common in CVE and Known Exploited Vulnerability records. Improper input validation was the most frequent weakness, while seven of the ten most common KEV weakness types in 2024 were MITRE’s “stubborn weaknesses”, representing 41.5% of that catalogue; CISA also highlighted path traversal and command injection as leading routes to real-world exploitation. The agency urged vendors to take responsibility for security outcomes by preventing these defect classes during development instead of relying on ever-larger patch releases.