CISA: most exploited bugs today are decades-old flaws

CISA's review of vulnerabilities actually exploited in 2024 and 2025 found that the most common ones are not new or exotic. They're the same flaw classes security researchers have been flagging for decades: improper input validation (CWE-20), injection bugs like SQL injection and OS command injection, cross-site scripting, and path traversal. Memory safety issues round out the list.

Seven of the top ten exploited weaknesses in 2024 match MITRE's "stubborn weaknesses" list, and three trace back to a 2007 assessment that already labeled them unforgivable. CISA's read: this isn't a technical-difficulty problem, it's organizational culture and development workflow gaps that let known, well-documented bug classes keep shipping.

The agency's push is toward Secure by Design: building validation and safe defaults into the development process itself, rather than patching after an exploit shows up in production. For a codebase without a dedicated security team, the practical version of that is unglamorous but specific. Validate and sanitize input at every boundary, not just the ones that look risky. Use parameterized queries instead of building SQL strings by hand. Treat path and filename input as hostile by default. Where the stack allows it, prefer memory-safe languages or libraries for anything parsing untrusted data. Track dependencies with an SBOM so a known-vulnerable package doesn't sit unnoticed for months.

None of these fixes are new. That's the point CISA is making: the flaws keeping incident responders busy in 2026 are the ones the industry already knew how to prevent twenty years ago.