What CISA's FY2024-2025 Vulnerability Review Means for Runtime Security

CISA's new Vulnerability Review for Fiscal Years 2024 and 2025 opens by correcting a widely held assumption. Cybersecurity conversations naturally gravitate toward nation-state adversaries and novel zero-days, but most compromises have not relied on advanced techniques. They exploited simple, known software vulnerabilities that stayed exposed in production, in some cases for years. While not a new argument, what is new is how precisely CISA's own data proves it, and how directly that data makes the case for the future of runtime security.

CVE Growth is Outpacing Exploitation

The scale is the first signal. The CVE catalog CISA analyzed grew from 14,234 records in FY2024 to 30,517 in FY2025, more than doubling in a single year, a trend the report ties in part to AI-accelerated vulnerability discovery. The Known Exploited Vulnerabilities (KEV) Catalog, CISA's list of CVEs with confirmed active exploitation, grew too, but far more slowly: 1,185 entries to 1,422.

That gap is the whole story. Tens of thousands of new vulnerabilities are published every year, but the ones threat actors actually use cluster tightly around a small, repeating set of weaknesses. CISA names six explicitly as the core drivers of real-world compromise:

• SQL injection (CWE-89): unsanitized input reaches a database query
• Improper input validation (CWE-20): the single most frequent weakness in both the KEV Catalog and CVE records, and the top attack vector CISA's own Risk and Vulnerability Assessment (RVA) teams found in hands-on engagements two years running
• Path traversal (CWE-22): access to files outside the intended directory
• Command injection (CWE-77/78): arbitrary commands run on the host
• Code injection (CWE-94): malicious code inserted and run inside the application
• Missing authentication for critical function (CWE-306): a critical operation left reachable with no auth check at all

Across FY2024 and FY2025, 41.5 percent of everything in the KEV Catalog mapped to what MITRE calls "stubborn weaknesses," flaws that have appeared on the industry's most-dangerous list every year since at least 2019. Three of today's top ten CWEs would have been considered "unforgivable" by MITRE's 2007 standard: a mistake so well-documented, with an attack path so obvious, that there is no excuse for it to still exist.

KEV Confirms a Fraction of What's Actually Exploited

Credit where it's due: CISA walking away from CVSS as the primary decision metric is a real step forward. CVSS, as the report itself admits, "reflects theoretical severity, not real-world impact." In its place, CISA's new guidance scores risk on exploitation status, technical impact, and, notably, whether a CVE sits on the Known Exploited Vulnerabilities Catalog, the list CISA maintains of vulnerabilities it has confirmed are being actively exploited.

That's a sharper question than "how scary does this sound on paper?" But it's worth being honest about what KEV actually is: CISA's own confirmed list, not a live census of everything under active attack. VulnCheck, which runs an independent exploitation-intelligence catalog, identified 884 vulnerabilities with evidence of active exploitation in 2025. CISA's KEV Catalog added 245 that same year, roughly 28 percent of what VulnCheck tracked. VulnCheck also found it had evidence of exploitation before CISA added the matching CVE to KEV more than 85 percent of the time, sometimes by months.

None of that is a knock on CISA specifically. Confirming exploitation at government scale, with the confidence needed to trigger federal remediation mandates, is hard, and a smaller, high-confidence list is more actionable than a noisy one. But it does mean "is this on the KEV list" is a useful floor, not a finish line. Treat it as the minimum bar for what needs attention, not the full picture of what's happening to you right now.

The Next Exploit Won't Wait for a CVE

Here's where it gets more urgent. CISA published this review, in its own words, "to establish a baseline of the vulnerability landscape prior to widespread AI-enabled vulnerability discovery." The report is explicit that threat actors "are using artificial intelligence (AI) to automate all the steps necessary to exploit these vulnerabilities" already, and that AI-enabled discovery is "rapidly increasing the volume of disclosed vulnerabilities, requiring ruthless patching prioritization."

Put that together with the report's own clustering data. The vulnerabilities that get exploited aren't spread evenly across all 30,517 CVEs published in FY2025, they cluster tightly around six recurring CWEs and the "stubborn weaknesses" that have shown up on MITRE's list every year since 2019. That clustering is genuinely useful: it tells you where to focus. But it also means the fastest-growing category of risk isn't "the CVEs already on the KEV list." It's the next instance of the same weakness class, found and weaponized by an AI-automated researcher before a CVE ID exists, let alone a KEV entry.

A prioritization framework keyed on known CVEs and confirmed exploitation can't, by definition, protect you from that. It's excellent for deciding what to patch once something is disclosed. It has nothing to say about whether a brand-new SQL injection or command injection bug in your own stack, one nobody has filed a CVE for yet, is being exploited against you right now.

How Oligo Delivers Definitive Prioritization and Real-Time Protection 

None of this argues that patching, secure coding, or CISA's Secure by Design push stop mattering. They're the front door. Software producers eliminating entire classes of memory-unsafe code, adopting SBOMs, and shipping products with authentication on by default is exactly the shift CISA is asking the industry to make, and it's the right long-term fix.

But the report's own numbers show that shift happening unevenly while the volume of new disclosures accelerates. Until every vendor ships entirely secure code and every organization patches inside CISA's recommended windows (both aren’t realistic), someone has to be able to catch and stop exploitation of these weakness classes the moment it happens, whether or not a CVE exists yet to describe it. That’s a problem for runtime context to solve, and it’s exactly what Oligo was built to do:

• ‍Watch what code actually executes: By watching code as it executes in production, Oligo provides definitive proof of whether a vulnerability can be exploited in your environment, enabling prioritization based on proof rather than probability. 

• Catch exploitation in progress: Runtime visibility enables customers to identify anomalous behavior based on how applications should behave at runtime. Oligo will detect a command injection or code injection attempt as it happens, regardless of whether a CVE exists.

• Block attacks in production: With a deep understanding of how applications should behave in production, Oligo is able to block exploit attempts without taking down the application, providing a compensating control for when a CVE either doesn’t exist or a patch hasn’t been deployed yet.

The Bottom Line

CISA wrote this report primarily to establish a baseline as AI-enabled vulnerability discovery makes the volume problem worse. But read against its own KEV data, the report makes the case for runtime security: the vulnerabilities that actually get exploited are a small, predictable, largely known set, and CISA's own scoring model now asks questions that only runtime evidence can answer.

Ready to detect and block entire classes of vulnerabilities, not chase one CVE at a time? Request a demo or talk to our team, and we'll walk through the full CWE-by-CWE breakdown of where runtime detection closes this gap today, and where it doesn't yet.