CISA reported CVEs more than doubled from 2024 to 2025, and 41.5% of known exploited vulnerabilities involve longstanding weaknesses like SQL
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) released vulnerability analysis results for fiscal years 2024 to 2025, showing that newly added CVEs increased from 14,234 in fiscal year 2024 to 30,517 in fiscal year 2025, more than doubling. This means publicly recorded weaknesses continue to grow rapidly, but the key factor affecting defensive effectiveness is not the total volume of vulnerabilities, but which weaknesses attackers actually exploit most often.
The same statistics also show that 41.5% of Known Exploited Vulnerabilities (KEV) involve weaknesses long tracked by MITRE, concentrated in types such as SQL injection, improper input validation, path traversal, command injection, code injection, and missing authentication for critical functions. These weaknesses all correspond to MITRE CWE Top 25 Most Dangerous Software Weaknesses, showing that attackers continue to exploit a set of classic flaws that have long been repeatedly identified but still not fully eliminated.
From an attack-surface perspective, an increase in CVE numbers does not necessarily mean risk rises linearly, but it does amplify the burden on security teams making decisions. When the vulnerability database expands rapidly, relying only on a single CVSS score for patching can easily distort priorities, causing situations where a high-scoring vulnerability is hard to exploit while a moderate-scoring one is already being actively exploited in the wild.
CISA specifically emphasizes that vulnerability prioritization should comprehensively consider whether an asset is exposed to the public internet, whether the vulnerability is listed in KEV, whether exploitation steps can be automated, and the technical impact after successful exploitation. The core of this approach is to turn "theoretical risk" into "practical risk." For defenders, public exposure, an automatable exploit chain, and confirmed in-the-wild exploitation often reflect true urgency better than a score alone.
The six categories of weaknesses reflected in KEV also have clear engineering significance. SQL injection, command injection, and code injection usually indicate failures in input handling and security boundaries; improper input validation and path traversal suggest insufficient data-flow control, which may lead to unauthorized file access or bypasses of permission mechanisms; missing authentication for critical functions directly opens the door to sensitive operations. These issues recur because they are not isolated mistakes, but systemic gaps in design, implementation, and testing.
In addition, CISA's cyber hygiene vulnerability scanning data shows that among U.S. critical infrastructure organizations scanned during fiscal years 2024 to 2025, 51% were still using end-of-support software, and 91% were still using deprecated SSL/TLS protocol. This indicates that even as new vulnerabilities keep emerging, large basic control gaps remain in existing environments. When foundational software has reached end of life and communication protocols are no longer secure, attackers often do not need the latest 0-day; they only need to find old weaknesses and old configurations to establish an entry point.
The AI factor is accelerating the situation further. CISA notes that AI not only speeds up vulnerability discovery, but also enables attackers to automate exploitation workflows more often. This means the time cost from scanning, verification, to attempted exploitation may decrease, compressing the patching window that once provided some buffer. In other words, patching speed and asset visibility have become more important than at any previous time.
The impact of this intelligence is not limited to governments or large infrastructure; it also applies to all organizations that rely on many third-party components, externally exposed services, and legacy systems coexisting. As long as there are public services, inherited legacy systems, vulnerability inventories that are not regularly audited, or old protocols that cannot be quickly retired, the same risk model may apply.
For critical infrastructure, the fact that 51% still use end-of-support software is especially concerning. It means that even if patches or security advisories exist, they may not be directly applicable because the product is no longer supported, leaving isolation, replacement, upgrading, or retirement as the only options. The fact that 91% still use deprecated SSL/TLS protocol shows that basic governance for authentication, encrypted transport, and server-side configuration is still inadequate, making man-in-the-middle attacks, downgrade attacks, and weak encryption risks persist over the long term.
From a governance perspective, CISA's shift in focus from CVSS scores to KEV, exposure, automation of exploitation, and technical impact also means security teams can no longer treat patching as a simple asset maintenance task; it should be viewed as attack-path-driven risk management. Without this prioritization capability, patching resources may be diluted by a large number of low-urgency weaknesses, while issues that are actually likely to be exploited are delayed.
First, establish a patching priority framework centered on KEV and make "whether the asset is publicly exposed" one of the highest-weighted factors. Public services, VPNs, remote management interfaces, API gateways, and web applications should be prioritized for rapid patching and validation processes.
Second, shift vulnerability management from single-factor CVSS prioritization to multi-factor ranking. In addition to the score, include exploit feasibility, the degree of attack automation, the business importance of the asset, data sensitivity, and lateral movement risk to avoid misallocating patching resources.
Third, for common issues such as SQL injection, input validation, path traversal, command injection, code injection, and missing authentication, move security checks earlier in the SDLC. During development, strengthen input validation, least privilege, parameterized queries, path normalization, command allowlists, and mandatory verification processes.
Fourth, immediately inventory end-of-support software and deprecated SSL/TLS protocol, and treat them as high-priority technical debt. If they cannot be retired in the short term, reduce exposure risk at minimum through network segmentation, access control, jump servers, mandatory encryption configurations, and monitoring alerts.
Fifth, in response to the trend of AI-automated exploitation, improve detection and response speed. Strengthen asset inventory, vulnerability scanning, patch verification, anomalous traffic detection, and attack-behavior correlation analysis at the same time to shorten the time from discovery to remediation.
In addition, CISA's Secure by Design principle is also worth incorporating into long-term strategy. If vendors reduce common security flaws during product design and development, the patching burden on organizations will materially decrease; otherwise, the growth in vulnerability numbers will only continue to increase operational and defensive pressure.