CISA Finds Decades-Old Bug Classes Still Dominate

The Good News Is We Already Know the Answers

CISA published its Vulnerability Review on August 28, 2026, analysing CISA and open source data across fiscal years 2024 and 2025. The Register covered the findings the same day. The headline result is not a new threat — it is the opposite, and that is genuinely useful.

The weaknesses being exploited in the wild right now are overwhelmingly classes the security field solved conceptually decades ago. Input validation. Injection. Path traversal. Nobody needs to invent a defence for these; the defences are written down, taught, and shipped in every major framework.

• 41.5% of KEV catalog entries came from MITRE's "stubborn weaknesses" — seven of the ten most frequent CWEs on the catalog fall into that group
• Improper input validation (CWE-20) topped both lists, ahead of cross-site scripting (CWE-79), OS command injection (CWE-78), SQL injection (CWE-89) and path traversal (CWE-22)
• Seven of the ten most frequent CWEs in 2024 CVE records were also stubborn weaknesses
• Memory safety and improper input validation together accounted for 16.7% of 2025 KEV entries

Why Do These Bugs Keep Shipping?

CISA's own answer is the part worth quoting the reasoning of: the agency attributes the persistence of these flaws to organisational culture, developer workflows and systemic gaps — not to technical difficulty. Three of today's most common vulnerabilities would have been classed as "unforgivable" nearly twenty years ago.

That reframing changes what you do about it. If the problem were hard, the fix would be research. Because the problem is process, the fix is process: where validation lives in a codebase, whether the framework's safe path is also the easy path, whether a team has time budgeted to remove a bug class rather than patch its instances one CVE at a time.

What Secure by Design Asks Vendors to Do

CISA is pressing software vendors on four points, and they are refreshingly concrete:

• Own security outcomes for customers rather than shipping oversized patch bundles and calling it done
• Eliminate whole stubborn and unforgivable weakness classes rather than fixing individual instances
• Improve automation around configuration, monitoring and updates
• Shift effort from reacting to threat actors toward removing preventable flaws before release

The third point is the one defenders can act on without waiting for a vendor. Automated configuration and update pipelines are the difference between a KEV entry being a two-hour job and a two-week one.

Why the Timing Matters for AI Security

CISA frames the review as establishing a baseline of today's vulnerability landscape before AI-enabled vulnerability discovery becomes widespread. That is a smart sequencing choice, and it is the reason this report belongs in our AI security coverage rather than filed as routine government output.

The reasoning runs like this. When automated discovery scales up, it will find these same classes faster than humans ever did, because injection and validation flaws are exactly the pattern-matchable kind. Organisations that have already removed those classes from their codebase will see a manageable increase in findings. Organisations that have not will see a flood. The window to do that work is now, while the baseline is still measured in human research speed.

This is a consistent thread in how CISA has been operating this year — we covered BOD 26-04 shifting federal patching to a risk-based model and the C4 framework scoring open source project trust, and both share this report's premise: prioritise by what is actually exploited, and fix causes rather than symptoms.

For anyone running their own infrastructure, the same logic applies at small scale. Our self-hosted LLM server security guide covers the basics, and the CISA review is a good reminder that the basics are still where the exploited bugs live.

Sources: CISA Vulnerability Review — August 28, 2026; The Register — August 28, 2026; SC Media — August 2026.