CISA Releases Vulnerability Review to Help Organizations Understand and Proactively Address Software Vulnerabilities

The Cybersecurity and Infrastructure Security Agency (CISA) released the CISA Vulnerability Review for fiscal years 2024 and 2025, offering critical insights into the root causes of insecure software and practical steps organizations can take to address the flaws threat actors frequently exploit. The review establishes a baseline understanding of the current vulnerability landscape before AI-enabled vulnerability discovery becomes more widespread. It emphasizes the importance of Secure by Design principles in shifting software cybersecurity efforts from reactive response to proactive risk management—backed by public-private sector collaboration and leadership support that recognizes cyber risk as a business risk and national security issue. The review also highlights how organizations can prioritize vulnerabilities for action by using the framework outlined in Binding Operational Directive 26-04: Prioritizing Security Based on Risk, which evaluates exposure status, known exploited vulnerability (KEV) status, potential for exploitation to be automated, and technical impact.

Key findings include:

• Many threat actors scan for and exploit simple, known vulnerabilities rather than relying on advanced techniques.

• Improper input validation and memory safety vulnerabilities are the most reliable entry points for threat actors and are frequently targeted.

• Basic security failures, like poor patching and continued use of end-of-support technology, significantly contribute to compromise.

• Emerging technology, such as AI, introduces efficiencies threat actors can leverage to automate and scale threat activity.

Organizations should focus on eliminating persistent and preventable weaknesses, prioritize remediation of KEVs and exposed assets, adopt Secure by Design principles, and leverage CISA’s no-cost resources, services and tools to help identify and reduce risk.

Read the CISA Vulnerability Review to review the full analysis and recommendations.

1. Additional Resources:

CISA’s Cross Sector Cybersecurity Performance Goals (CPGs) 2.0—a prioritized, outcome focused baseline that maps to NIST CSF 2.0.

2. Stakeholder Specific Vulnerability Categorization (SSVC)—decisioning to focus remediation on what matters: exposure, KEV status, exploit automation, and technical impact.

3. Internet Exposure Reduction Guidance—practical steps to find and close exposed services quickly.

4. Vulnrichment Program—machine readable signals on KEV/exploitation that help you automate patch prioritization.

5. Risk & Vulnerability Assessments (RVAs)—on site penetration tests that reveal how real world cyber threat actors could exploit persistent weaknesses in an organization’s environment and provide clear, actionable steps to reduce those risks.

6. Cyber Hygiene (CyHy) Scanning—no cost services to quantify and reduce risk across external attack surfaces.