CISA: Most exploited vulnerabilities should have been eradicated decades ago
- ID
- 19015
- Status
- summarized
- Published
- 28 Aug 2026, 7:29 PM
- Fetched
- 28 Aug 2026, 8:34 PM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/security/2026/08/28/cisa-most-exploited-vulnerabilities-should-have-been-eradicated-decades-ago/5293194
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 6.5
- Created
- 28 Aug 2026, 8:36 PM
- Tags
- Audience
- developersvibe_coderssaas_founders
What happened
CISA's 2024-2025 review found that the majority of vulnerabilities making it to the Known Exploited Vulnerability (KEV) catalog are decades-old flaw classes—SQL injection (CWE-89), XSS (CWE-79), OS command injection (CWE-78), improper input validation (CWE-20), and path traversal (CWE-22). Seven of the top 10 CWEs in both CVE and KEV records match MITRE's 2007 'unforgivable vulnerabilities' list, and three of the top five KEVs stem from these same unfixed holes.
Why it matters
If you're shipping code or reviewing PRs, the highest-impact security investment is still boring input validation and parameterized queries—not chasing novel threat vectors. CISA's data shows 41.5% of KEV catalog bugs are 'stubborn weaknesses' that static analysis and basic code review should catch. For Malaysian SaaS founders handling PDPA-sensitive data, this is a concrete argument for budgeting SAST/DAST tooling and secure code training over flashier security spend.
Discussion angle
Why are injection flaws still dominating exploitation in 2025 when frameworks have had parameterized queries and output encoding for over a decade—is it legacy code, framework misuse, or vibe-coded glue code that skips validation?