Why the Same Old Bugs Keep Getting Exploited: CISA's Secure-by-Design Wake-Up Call

Every year, security professionals uncover a multitude of new vulnerabilities. However, a recent review by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) revealed that many of the vulnerabilities most frequently exploited were not novel at all. In fact, they were well-known classes of defects that had been understood for years, if not decades, and should have been eliminated during the design phase of software products.

The reason these outdated vulnerabilities persist is not because attackers are getting more sophisticated, but rather because software vendors are not adhering to secure-by-design principles. When software is not built with security in mind from the start, the same design flaws resurface in new products, leading to fresh CVEs and patch cycles.

One such recurring vulnerability class is authentication bypass. Products may ship with default administrative credentials or authentication checks that can be bypassed under certain conditions. When researchers or attackers discover such flaws, a patch is released. However, because the secure design pattern was not enforced, other products from the same vendor often exhibit structurally similar flaws.

This explains why CISA continues to add entries to its Known Exploited Vulnerabilities (KEV) catalog, even for products with flaws similar to those in the past.

For defenders, the implications of this finding are clear. Rather than solely focusing on chasing the newest CVEs, defenders should prioritize vulnerabilities listed in the KEV catalog, especially those that have been actively exploited. A medium-severity vulnerability that is being exploited should be treated with higher urgency than a critical vulnerability with no exploitation evidence. Default credentials, in particular, should be treated as a critical defect and not simply a configuration issue.

In addition, defenders should continuously inventory all internet-facing assets to ensure they are aware of potential vulnerabilities. Exposure is often the first step in most remote exploits, so having a comprehensive inventory is crucial. It is also essential to push vendors to commit to secure-by-design practices during procurement.

Ask for evidence of threat modeling, secure defaults, and a robust vulnerability disclosure process. Finally, aim to reduce the time to patch known-exploited vulnerabilities to days rather than months, as the window between disclosure and exploitation is becoming increasingly narrow.

Ultimately, the lesson from CISA's review is not that new vulnerabilities should be ignored, but rather that the industry must address the same mistakes repeatedly by adopting secure design principles as the default rather than an option. Until this change occurs, the industry will continue to grapple with preventable security issues.