The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday published its CISA Vulnerability Review, which examines the root causes of insecure software and basic security failures. Drawing on CISA and open-source data from fiscal years 2024 and 2025, the review provides vulnerability insights and tools to help software producers and organizations reduce cyber risk. The review also highlights the role of Secure by Design principles in shifting cybersecurity from a reactive approach toward proactive risk reduction. It outlines how organizations can prioritize vulnerabilities based on exposure status, known exploited vulnerability (KEV) status, exploit automation and technical impact.
“Organizations must shift from reacting to threat actors to fixing the fundamental flaws those actors are known to exploit,” according to the document. “Stronger cybersecurity begins with software that is secure by design. It requires prioritization of vulnerabilities and collaboration across industry and government. Finally, it demands leadership attention to understand cyber risk as a business risk, a national security threat, and an impediment to operational resilience.”
CISA continues to see preventable gaps in CVEs, such as missing Common Vulnerability Scoring System (CVSS) fields, lack of CWE attribution, and incomplete descriptions. Those omissions slow triage, undermine security automation workflows, and increase risk across the ecosystem. CVE completeness is not just a best practice; it’s a necessity. Analysis of CVE records shows the persistent recurrence of a relatively small set of CWEs. Many of these common weaknesses stem from avoidable coding errors, such as improper input validation and injection flaws. By incorporating Secure by Design principles that address these simple errors into software development, software providers can prevent entire classes of vulnerabilities and reduce opportunities for exploitation.
In FY2024, the top 10 CWEs accounted for 5.9% of all CVEs. Notably, two of those top 10 were injection flaws. These weaknesses allow threat actors to insert malicious code through trusted input channels— common examples include cross-site scripting (XSS), operating system command injection, and SQL injection. Across the full dataset, injection-related weaknesses made up 10.1% of all CVEs.
The FY2025 picture looks much the same. XSS again dominated the top 10, underscoring the persistence of poor input validation practices that allow threat actors to inject malicious scripts directly into user browsers, which can lead to session hijacking, credential theft, and unwanted redirects. Injection weaknesses overall represented 9.2% of all CVEs. This slight decrease from 2024 is still a substantial share of the total vulnerability landscape. Threat actors continue to succeed, in part, because simple, preventable software weaknesses remain unaddressed. Resolving fundamental issues would eliminate a significant portion of today’s most common compromises.
The CISA Vulnerability Review detailed that in FY2024 and FY2025, memory safety and improper input validation weaknesses appear disproportionately in KEVs compared to the full CVE population. For software providers, this finding underscores the importance of addressing the underlying weaknesses that often translate directly into real‑world exploitation. By reducing these root causes during software development, providers can help prevent vulnerabilities that are more likely to be targeted by threat actors.
This comes as hackers use simple, reliable techniques that work across multiple products and environments. “Rather than relying on novel exploits, they repeatedly target the same weakness classes that resurface in software. KEVs give threat actors the clearest path to initial access. Software producers should apply Secure by Design practices and reinforce baseline coding standards to directly reduce compromise. Organizations should prioritize KEV remediation and investigate exposures for indicators of compromise. Fast patching and disciplined software hygiene shut down most exploitation pathways in the KEV Catalog.”
Access control weaknesses occur when authorization checks are missing, allowing users to exceed intended privileges and enabling threat actors to escalate access or reach restricted functionality. Organizations should apply authorization checks to all sensitive actions, centralize control logic to reduce implementation errors and gaps, and regularly test enforcement through code reviews and automated testing to confirm that protections work as intended.
Multiple weakness categories can be exploited together, with threat actors chaining issues such as input-validation failures and access control gaps, highlighting the interconnected nature of software weaknesses.
Organizations should prioritize patching weaknesses that are commonly exploited together, embed Secure by Design practices throughout the development lifecycle, and continuously monitor and test systems to identify and mitigate multi-step exploitation paths. When purchasing software, organizations should also ask producers about measures in place to address common software weaknesses and prioritize vendors that demonstrate proactive efforts to reduce vulnerabilities in their products. Software should also be routinely maintained and updated to the latest available version to mitigate avoidable vulnerabilities.
When the CVE list is compared with CISA’s Known Exploited Vulnerabilities (KEV) and RVA findings, the playbook for threat actors becomes clear. Injection flaws account for a large share of the CVE dataset but rarely succeed in cyber-mature environments. By contrast, memory safety and improper input validation weaknesses represent some of the most reliable paths to exploitation, accounting for 19.7% of KEVs in fiscal year 2024 and 16.7% in fiscal year 2025.
In FY2024 and FY2025, CISA designated 520 CVEs for action across critical infrastructure entities, each reflecting a potential exploitable weakness. To prioritize CVEs effectively, CISA applies its SSVC decision tree, which evaluates real-world contextual risk through five factors: exploitation status, technical impact, automatable exploitation, mission prevalence, and public well-being impact.
The CISA Vulnerability Review recognized that after improving vulnerability prioritization through SSVC, the next challenge is execution, and the data is mixed. “Between FY2024 and FY2025, CISA observed meaningful progress: critical infrastructure organizations are patching KEVs faster, and fewer organizations are leaving KEVs exposed beyond the first 30 days. This is a step forward, but still short of what current operational pressures demand.”
It added that most organizations continue to miss CISA’s recommended remediation timelines, leaving systems unnecessarily exposed. Even with year-over-year reductions in exposed KEV instances, the operational risk remains high. Every delayed patch extends the window of opportunity for threat actors, especially when dealing with KEVs.
Beyond software weaknesses, exposed network services remain one of the simplest paths to compromise. CISA found that 26% of critical infrastructure entities scanned in FY2024 and FY2025 exposed vulnerable network services. These include standard protocols that threat actors regularly exploit using techniques mapped to the MITRE ATT&CK framework.
Using File Transfer Protocol (FTP) is the most common issue, with roughly 18% of scanned entities running FTP servers. FTP lacks encryption and strong authentication, allowing threat actors to intercept credentials sent in clear text, abuse default accounts, and exploit FTP software bugs to steal data or plant malware. In 2025, major flaws in tools such as Cleo MFT, CrushFTP and Wing FTP enabled threat actors to obtain administrator access or execute remote code, facilitating ransomware attacks and activity by initial access brokers.
Other high-risk services include Remote Desktop Protocol (RDP), which is a common entry point for ransomware groups. Internet-exposed RDP revealed domains and enabled Chinese government-affiliated cyber actors to conduct lateral movement using BRICKSTORM malware in 2025. Server Message Block (SMB) is another concern because threat actors can use it to spread malware and escalate privileges. In October 2025, CISA added CVE-2025-33073 to the KEV Catalog following active exploitation of a critical SMB flaw. Telnet also remains a risk because it is outdated and unencrypted but continues to be used on legacy and Internet of Things (IoT) devices. In January 2026, CISA added CVE-2026-24061 to the KEV Catalog for a Telnet vulnerability that grants unauthenticated root access.
These services can provide threat actors with open doors into organizations. Organizations should disable unnecessary and insecure services and implement strict security controls for services that must remain operational, including encryption and strong authentication.
When it comes to emerging technology risks, the CISA Vulnerability Review identified several challenges that organizations must address. As organizations work to eliminate deprecated protocols and end-of-support (EOS) technologies, they face a broader challenge: the digital landscape is accelerating, not merely evolving. Rapid adoption of new technologies, growing system interconnectivity and AI-enabled threats are reshaping the attack surface faster than defenders can respond.
Hyperconnected systems mean that one weak link can expose entire supply chains, creating an interdependence that adversaries can exploit. AI introduces efficiencies that threat actors can leverage to automate phishing, identify vulnerabilities faster and scale their operations. At the same time, legacy IT and unsupported software remain persistent liabilities, leaving unpatched flaws that can become easy entry points for intrusions.
CISA urges software producers to reduce security burden on customers by building products that are secure at inception rather than relying on constant monitoring, patching and emergency response. Software producers need to automate configuration, monitoring and routine updates, own security outcomes for their customers, embed security into every phase of design and development, and eliminate common vulnerability classes while publishing roadmaps for addressing the remaining ones.
CISA recommends that producers consult the joint guidance, Safe Software Deployment: How Software Manufacturers Can Ensure Reliability for Customers, to take responsibility for customer security. This approach, which treats security as a core engineering requirement, requires technical discipline and executive buy-in. The agency also provides various resources to help organizations build security in from day one, including the Secure by Demand Guide: How Software Customers Can Drive a Secure Technology Ecosystem, Product Security Bad Practices, Exploring Memory Safety in Critical Open Source Projects, and The Case for Memory Safe Roadmaps.
Critically, the Secure by Demand Guide directs customers on how to use procurement to drive market demand for Secure by Design products. By establishing clear security requirements before signing contracts, organizations create incentives for software producers to build more secure products.
To support these purchasing decisions, the Secure by Demand Guide highlights key questions customers can ask to evaluate whether a product is secure by design and capable of delivering better outcomes. These include whether security patches are simple to install and automatic updates are enabled, whether single sign-on is available at no additional cost, whether the product offers multifactor authentication (MFA) or phishing-resistant authentication by default, whether default passwords have been eliminated, which vulnerability classes the producer has already eliminated and what the roadmap is for addressing the remaining classes, whether security logs are included in the base product, whether the software producer provides a machine-readable software bill of materials (SBOM), and whether Common Weakness Enumeration (CWE) and Common Platform Enumeration (CPE) fields are accurately included for every CVE.
The CISA Vulnerability Review mentioned that SBOM is now essential to software security and supply chain risk management (SCRM). It acts as an ingredient list for software, showing every component inside. Without it, finding vulnerabilities becomes a guessing game. The conversation has shifted from ‘What is an SBOM?’ to ‘I have one. How do I use it?’ The answer is automation and interoperability, supported by standardized formats and tools across the supply chain. CISA is driving SBOM adoption across government and industry through initiatives focused on scaling and operationalizing SBOMs.
SBOMs are transforming government cybersecurity by improving supply chain visibility and resilience. CISA is leading this effort across the Federal Civilian Executive Branch (FCEB), Department of War (DoW), and intelligence community (IC), providing implementation guidance and best practices. CISA is identifying tools to build a tailored toolkit for generating and consuming SBOMs for internally developed software. Integrating these tools into continuous integration/continuous delivery (CI/CD) pipelines will strengthen software assurance and supply chain security efforts across CISA and the broader FCEB.
The SBOM Minimum Elements set the baseline for implementation. CISA’s 2026 Minimum Elements for SBOM takes this further by adding new data fields, practices and processes to reflect advances since the original 2021 National Telecommunications and Information Administration (NTIA) standard. Moreover, advances in SBOM tools and real-world use are driving these updates. The final version will help agencies and organizations manage software risk more effectively.
In conclusion, the CISA Vulnerability Review observed that securing the software ecosystem is a shared responsibility, with software producers and end-user organizations both playing a critical role. Software producers should implement Secure by Design principles, adopt SBOMs and embrace self-attestation to protect users and build trust. Organizations should choose vendors that prioritize security from the start, providing the fastest path to a stronger security posture.
