CISA Issues Comprehensive Vulnerability Review for Fiscal Years 2024-2025, Emphasizes Basic Security Failures and Prioritization Framework

WASHINGTON, D.C. - The Cybersecurity and Infrastructure Security Agency (CISA) has released its Vulnerability Review, analyzing vulnerability data from fiscal years 2024 and 2025 to establish a baseline of the current threat landscape. The report finds that most cyber compromises do not rely on advanced techniques or cutting-edge tools, but rather on exposed, well-known software vulnerabilities where basic security failures have left systems vulnerable.

The review identifies common software weaknesses that contribute to exploitable vulnerabilities and details practices software producers can adopt to prevent these weaknesses from recurring. By examining patterns across vulnerability data, the report helps organizations focus on systemic improvements that can reduce entire classes of vulnerabilities rather than addressing individual flaws only after discovery.

A key component of the review is the framework outlined in Binding Operational Directive 26-04: Prioritizing Security Based on Risk. This framework evaluates vulnerabilities using four critical criteria: exposure status, Known Exploited Vulnerability (KEV) Catalog status, potential for automated exploitation, and technical impact. CISA emphasizes that organizations can significantly reduce risk by addressing underlying weaknesses and prioritizing vulnerabilities based on the risk they pose.

The review also underscores the importance of Secure by Design principles, shifting cybersecurity efforts from reactive responses to threat actors toward proactive fixing of preventable software flaws. CISA establishes this baseline analysis before AI-enabled vulnerability discovery becomes more widespread, providing organizations with actionable insights to improve their security posture.

The report is available at cisa.gov and serves as a critical resource for organizations seeking to reduce their attack surface and improve vulnerability management practices.