CISA's Vulnerability Review Is a Warning: AI Is About to Make Your Known Weaknesses Everyone's Problem

AI Security

CISA published its first-ever Vulnerability Review today — a 31-page analysis of the national vulnerability landscape across fiscal years 2024 and 2025. The timing is deliberate. In the Executive Summary, CISA states plainly that it is publishing this baseline now specifically because AI-enabled vulnerability discovery is rapidly increasing the volume of disclosed vulnerabilities, and because threat actors are already using AI to automate all the steps necessary to exploit them.

That framing is the document's most important sentence. CISA isn't just releasing a retrospective. It's establishing a pre-AI exploitation baseline — a snapshot of what the vulnerability landscape looks like before widespread AI-enabled discovery and exploitation changes the picture permanently. Everything that follows in the document should be read against that context.

For healthcare security teams, the findings land in familiar territory: the same foundational weaknesses that have been documented for years are still the primary drivers of compromise, they're still present in healthcare-connected software, and the window to fix them before AI-accelerated scanning finds them first is narrowing.

The Core Finding: Sophistication Is Not the Problem

The report opens with a finding that cuts against the dominant narrative in security marketing: most compromises in FY2024 and FY2025 were not driven by nation-state actors leveraging zero-day exploits. They were driven by opportunistic criminals scanning the internet for exposed vulnerabilities created by insecure software. Basic security failures — unpatched known vulnerabilities in publicly exposed assets — enabled most of what CISA observed.

This matters for healthcare organizations that have internalized a threat model centered on sophisticated adversaries. The sophisticated actors are real, and they're covered in the report. But the data shows that the volume of successful compromises is driven by opportunistic exploitation of preventable weaknesses. Healthcare environments that remain exposed to known vulnerabilities in internet-facing systems are not protected by the assumption that attackers will focus on higher-value targets.

The AI dimension changes this calculus further. CISA's explicit framing is that AI is now automating the full exploitation pipeline — scanning, vulnerability identification, and exploitation steps. What was previously constrained by attacker time and skill is becoming automated and scalable. The report is establishing the baseline precisely because the authors expect this picture to get significantly worse before the next review.

The Vulnerability Data: What FY2024 and FY2025 Actually Show

Injection Flaws Dominate — And Got Worse

Figure 1.1 in the report is the most striking data visualization in the document: a Sankey diagram mapping the top 10 CWEs across all CVE records. In FY2024, the CVE catalog contained 14,234 total CVEs. The top weakness was CWE-79 (Cross-Site Scripting) at 5,384 instances, followed by CWE-89 (SQL Injection) at 2,317. Injection-related weaknesses in total accounted for 7,701 CVEs — more than half of the top-10 total.

By FY2025, CWE-79 alone had grown to 11,107 instances. The injection category total hit 21,019. That's not a marginal increase — it's a near-tripling of the injection vulnerability count in a single fiscal year. CISA attributes injection weakness persistence to input validation failures that have remained unaddressed at the software development level across a wide range of products.

For healthcare, the injection flaw picture is direct: EHR systems, patient portals, healthcare APIs, and clinical decision support tools are all software products. Injection vulnerabilities in those products are not theoretical — they're the documented majority of what's in the CVE catalog.

Stubborn Weaknesses and Unforgivable Vulnerabilities

The report introduces two frameworks for understanding why the same weaknesses persist year over year. "Stubborn weaknesses" are CWEs that appear consistently across CVE records and KEVs despite being well-documented and well-understood. In both FY2024 and FY2025, 7 of the top 10 CWEs in the KEV Catalog — comprising 41.5% of all KEVs — were stubborn weaknesses. These are not novel vulnerabilities; they're recurring failures in the same weakness categories that CISA has been documenting for years.

The second framework is MITRE's 2007 concept of "unforgivable vulnerabilities" — weaknesses that were considered inexcusable to ship more than two decades ago because the fixes were well-understood and available. Three of today's top 10 CWEs would have been considered unforgivable by that 2007 standard. Their persistence in modern software is, as CISA states, not a problem of technical complexity. It's a problem of organizational culture, developer workflows, and systemic gaps in Secure by Design adoption.

For healthcare vendor management programs: the stubborn weaknesses list and the unforgivable vulnerability framework are both tools for vendor security assessment conversations. If a vendor's software is shipping with injection flaws, path traversal vulnerabilities, or OS command injection issues in 2026, the gap isn't technical — it's developmental practice.

KEVs: The Patch Playbook

The report's treatment of the Known Exploited Vulnerabilities (KEV) Catalog is particularly relevant for healthcare. CISA analyzed the top CWEs among KEVs and found that they don't mirror the broader CVE landscape — they cluster tightly around a smaller group of reliably exploitable weakness types that offer consistent, scalable attack paths.

Memory safety and improper input validation weaknesses appear disproportionately in KEVs compared to the full CVE population. Seven of the top 10 CWEs in FY2025 KEVs were in the injection, improper input validation, or file-handling categories. This clustering tells the story: threat actors are not randomly picking from the vulnerability catalog. They're targeting the weakness classes that translate reliably into initial access across multiple products and environments.

CISA designated 520 CVEs for action across critical infrastructure entities in FY2024 and FY2025 via the Stakeholder-Specific Vulnerability Categorization (SSVC) framework. Healthcare organizations should note that CISA explicitly states that SSVC — not CVSS scores — is the recommended prioritization method. CVSS scores reflect theoretical severity, not real-world exploitability context. SSVC evaluates exploitation status, technical impact, automatable exploitation potential, mission prevalence, and public well-being impact. For healthcare systems where mission prevalence (clinical impact of downtime) is high, SSVC will consistently surface different prioritization outcomes than CVSS alone.

Exposed Network Services in Critical Infrastructure

CISA's CyHy (Cyber Hygiene) scanning data provides the clearest operational picture in the report. CyHy enrollment grew from 8,852 organizations in FY2024 to 10,890 in FY2025 — a meaningful increase in visibility into national cyber risk trends.

The findings from that scanning are direct: 26% of critical infrastructure entities scanned in FY2024 and FY2025 exposed vulnerable network services. The top offenders are protocols that have been deprecated, replaced, or hardened against for years: FTP at roughly 18-19% of scanned entities, RDP as a common ransomware entry point, SMB (with CVE-2025-33073 added to the KEV Catalog in October 2025 after active exploitation), and Telnet still present on legacy and IoT devices.

The healthcare parallel is exact. Healthcare organizations run the same protocols: legacy FTP servers for lab result file transfers, RDP for remote clinical workstation access, SMB shares for imaging and document management, and Telnet on older biomedical and building management systems. The CISA data is not describing a problem unique to energy or manufacturing. It's describing the operational reality of any organization that has accumulated technical debt across a complex infrastructure.

The report also flags end-of-support (EOS) software and hardware as a compounding factor — conditions that eliminate the possibility of patching and dramatically increase exploitability. The report notes that 51% of scanned entities ran unsupported software (the full figure is cut off in the visible pages, but the direction is clear). Healthcare environments with aging clinical systems, legacy radiology equipment, and biomedical devices running end-of-life operating systems are directly in scope for this finding.

The AI-Enabled Exploitation Shift

The Cyber Risk Landscape section (Part 1) makes the AI connection explicit: CISA changed how it views and prioritizes risk specifically because AI-enabled vulnerability discovery is rapidly increasing the volume of disclosed vulnerabilities, requiring what the report calls "ruthless prioritization." This is the document's most forward-looking content, and it's where the baseline framing becomes most significant.

The report doesn't provide a detailed technical breakdown of AI-enabled exploitation techniques — that's not its purpose. But the baseline it establishes is the reference point against which AI-accelerated discovery will be measured. When the next vulnerability review is published, the delta between this baseline and the new state will tell the story of how quickly AI has changed the exploitation timeline.

For healthcare security programs, the practical implication is timeline compression. Vulnerabilities that currently sit in the KEV Catalog for weeks before most organizations patch them will, under AI-accelerated exploitation, be weaponized faster. The SSVC framework's "Act" designation — requiring immediate action with leadership engagement and rapid mitigation — will become more frequently relevant as the time between CVE publication and active exploitation shortens.

Secure by Design and the SBOM Shift

Part 1 of the report concludes with CISA's Secure by Design framework as the structural response to persistent weaknesses. The argument is straightforward: if injection flaws and memory safety vulnerabilities continue to appear in the top 10 CWEs year over year, the problem is not remediation speed — it's software development practice. Secure by Design means addressing these weaknesses at the source, before they become CVEs.

The SBOM section is worth noting for healthcare vendor management programs. The report documents a shift in the SBOM conversation from "what is an SBOM?" to "I have one. How do I use it?" CISA is now driving SBOM adoption across the federal civilian executive branch, Department of Defense, and intelligence community, providing implementation guidance and integrating SBOMs into CI/CD pipelines. The 2026 Minimum Elements for a Software Bill of Materials publication (also released this month) is the current reference.

For healthcare organizations evaluating software vendors: SBOM availability is an increasingly relevant procurement question. A vendor who cannot provide an SBOM for healthcare-facing software cannot support the supply chain visibility that the CISA Vulnerability Review identifies as essential to managing software risk.

Part 2: What Organizations Should Do

Part 2 of the report is the action section, anchored to CISA's Cybersecurity Performance Goals (CPGs) 2.0 and Binding Operational Directive 26-04. The CPGs are CISA's minimum recommended security baseline for critical infrastructure organizations — they're not mandatory for private sector healthcare, but CISA states explicitly that it expects them to become a standard of care.

The four SSVC variables driving prioritization decisions — Asset Exposure, KEV Status, Exploit Automation potential, and Technical Impact — map directly to the questions healthcare security programs should be asking about their vulnerability inventory. The report frames BOD 26-04 (Prioritizing Security Based on Risk) as the companion directive, and the KEV Catalog as the patch playbook. For healthcare organizations not subject to federal directives, the KEV Catalog remains the highest-signal vulnerability prioritization input available.

The recommendations also include CyHy enrollment as a no-cost resource. Healthcare organizations that aren't enrolled in CISA's CyHy scanning are missing the clearest external view of their internet-facing exposure.

The Baseline That Matters

CISA chose the phrase "establish a baseline of the vulnerability landscape prior to widespread AI-enabled vulnerability discovery" deliberately. It's an acknowledgment that the current picture — documented injection flaws, stubborn weaknesses, exposed network services, end-of-support systems — represents the pre-AI state. What comes next is a landscape where the same foundational weaknesses are discovered and exploited at machine speed.

Healthcare organizations that use this report as a checklist against their own environments — injection flaw prevalence in vendor software, exposed network services in the CyHy categories, SSVC prioritization against their KEV exposure, SBOM availability in vendor contracts — are using it as CISA intended. The organizations that read it as a description of someone else's problem are the ones the next baseline will document.