The Same Flaws Keep Getting Exploited: Reading CISA's Secure-by-Design Review as an Operations Problem

CISA reviewed the vulnerabilities exploited during 2024 and 2025 and reported a pattern that should be uncomfortable for anyone running a patch program: most of the exploited flaws were not new discoveries. They were defects that had been identified years earlier, and in many cases fixed, on systems where the fix was never applied.

The finding is easy to read as a vendor criticism. CISA does make that argument, pointing to slow adoption of secure-by-design development practices. But the operational reading is more useful for defenders, because the exploited set is largely composed of flaws that were already public, already patched and still reachable.

What the review actually shows

Three characteristics recur across the exploited vulnerabilities:

• they affect internet-facing components, so reachability does not require a user action;
• they were disclosed well before the exploitation window, meaning defenders had patch availability and time;
• they persist on systems that are difficult to update, including edge appliances, embedded devices and end-of-support software.

That third point is the one that turns a patch management problem into an architecture problem. A firewall or VPN concentrator that cannot be rebooted during business hours, or that reached end of support three years ago, will keep appearing in exploited-vulnerability statistics regardless of how quickly the vendor ships a fix.

Why the patch did not land

The review does not claim that defenders ignored the advisories. The more common failure modes are structural:

Inventory gaps. An organization cannot patch a device it does not know it owns. Edge appliances are frequently procured by network teams, tracked in a spreadsheet, and invisible to the vulnerability management platform that scans servers.

Maintenance windows. A remote-access gateway that terminates employee VPN sessions has no convenient time to go down. The patch gets deferred until the next holiday, and the next holiday is months away.

End-of-support hardware. When a vendor stops shipping fixes, the only remaining options are replacement or compensating controls. Both take budget and lead time, so the device stays in place.

Ownership ambiguity. For appliances that sit between teams, nobody is certain who is responsible for patching. The advisory is read by the security team, the device is managed by the network team, and neither closes the loop.

What to do differently

The review implies a different prioritization than most vulnerability management programs use. Instead of scoring every finding by CVSS, treat the exploited set as a category of its own:

1. Build a reachability inventory for internet-facing systems. This includes appliances, not just servers. If it terminates a session or accepts a connection from the internet, it belongs on the list.
2. Track end-of-support dates as a risk input. A device without a vendor patch path is a permanent finding, and it should be visible to whoever approves the budget.
3. Pre-authorize maintenance for edge devices. If every reboot requires a change advisory board meeting, the patch will lose to operational pressure.
4. Assign a named owner per device class. Ambiguity is the reason patches sit unapplied.

None of these steps require new tooling. They require deciding that an internet-facing appliance with a known exploited vulnerability is a different kind of problem from an internal server with the same score.

The limit of the review

CISA's review is a retrospective, not a forecast. It describes what was exploited in a two-year window, and the sample is weighted toward vulnerabilities that attackers found worth using. It does not tell you which of your current findings will appear in the next review.

What it does establish is that the exploited population is dominated by known, patchable, reachable flaws. That is a solvable problem, and it is not solved by better detection. It is solved by knowing what you own, knowing what faces the internet, and having a maintenance path that does not depend on finding a quiet weekend.

References

• CISA, review of the most exploited vulnerabilities of 2024-2025 and secure-by-design findings.
• CISA Known Exploited Vulnerabilities catalog.
• CISA, "Secure by Design" guidance.