Why the Same Old Bugs Keep Getting Exploited: CISA's Secure-by-Design Wake-Up Call

Every year the security industry discovers thousands of new vulnerabilities. Yet when the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reviewed which flaws attackers actually exploited across 2024 and 2025, the answer was uncomfortable: most of the most-abused vulnerabilities were not novel at all. They were well-known classes of defect that had been understood for years, sometimes decades, and that should have been designed out of products long ago.

Why the reader should care

If your security program is organized around chasing the newest CVE, this finding reframes the problem. The threats that cause the most real-world damage are often the ones with the longest public track records. That means the highest-return defensive work is frequently unglamorous: patching known issues, removing default credentials, and demanding that vendors build security in rather than bolt it on.

Technical context

CISA's review points to a persistent pattern. The most-exploited vulnerabilities cluster into familiar categories: authentication bypass, command injection, path traversal, improper access control, and unsafe deserialization. These are not exotic memory-corruption puzzles. They are design and coding failures with well-documented root causes and well-understood fixes.
The agency's conclusion is that the root cause is not attacker sophistication but vendor practice. When software is not built with "secure by design" principles, the same defect classes reappear across generations of products. Each reappearance becomes a fresh CVE with a fresh patch cycle, even though the underlying mistake is old.

Explanation and walkthrough

Consider how a single recurring class, authentication bypass, produces repeated incidents. A product ships with a default administrative credential or an authentication check that can be skipped under certain request conditions. Researchers or attackers find it. A patch is issued. Years later, a different product from the same vendor ships with a structurally similar flaw because the secure pattern was never made mandatory.
The pattern explains why CISA keeps adding entries to its Known Exploited Vulnerabilities (KEV) catalog for products whose flaws resemble earlier ones. The catalog is not just a patch list; it is a record of design lessons that were not learned.

Defensive implications

For defenders, the practical takeaways are concrete.

• Prioritize KEV-listed vulnerabilities over raw CVSS scores. A medium-severity flaw under active exploitation is more urgent than a critical flaw with no exploitation evidence.
• Treat default credentials as a critical defect, not a configuration nuisance. Many exploited flaws begin with a credential that should never have shipped.
• Inventory internet-facing assets continuously. You cannot patch what you have not found, and exposure is the precondition for most remote exploitation.
• Push vendors on secure-by-design commitments in procurement. Ask for evidence of threat modeling, secure defaults, and a vulnerability disclosure process.
• Reduce time-to-patch for known-exploited issues to days, not months. The window between disclosure and exploitation is shrinking. The lesson from CISA's review is not that new vulnerabilities do not matter. It is that the industry keeps paying for the same mistakes. Until secure design becomes the default rather than an option, defenders will keep fighting fires that should never have been lit.

References

• CISA review of most-exploited vulnerabilities 2024-2025 (Secure by Design), reported 2026.
• CISA Known Exploited Vulnerabilities (KEV) Catalog, retrieved 2026-09-19.
• CISA KEV additions 2026-08-26 (Citrix NetScaler, Microsoft SQL Server, Red Hat, Linux kernel, Ajax.NET).