Updated under an hour ago ()
Weaknesses that keep coming back
Which flaw types keep getting exploited year after year, and what should we ask vendors and configure ourselves?
Of the 1,429 vulnerabilities CISA confirmed exploited in 2022 to 2026, 1,277 carry a CWE weakness id. The most common are CWE-787 Out-of-bounds Write (97), CWE-78 OS Command Injection (94) and CWE-416 Use After Free (80).
What this means for you
Five weakness types cover 31% of the exploited CVEs with a CWE. These are old, well-understood flaw classes: ask vendors what they do to rule them out, not only how fast they patch.
Do this next
This chapter's program actions come with a subscription
a. The usual suspects
The weaknesses behind confirmed exploitation
Exploited CVEs by CWE (top 12)
CWE-787 Out-of-bounds Write is the most common weakness among exploited CVEs in 2022 to 2026 (97 CVEs); the top five together cover 31% of the CVEs with a CWE.
Sources: CISA Known Exploited Vulnerabilities catalog; CVE Program, cvelistV5 records; MITRE CWE List
Table view
| CWE-787 | Out-of-bounds Write | 97 | 8% | 4 of 5 | Memory safety (overflows, use after free) |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | 94 | 7% | 5 of 5 | Injection (SQL, OS command, code, XXE) |
| CWE-416 | Use After Free | 80 | 6% | 4 of 5 | Memory safety (overflows, use after free) |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 64 | 5% | 4 of 5 | Path traversal and unsafe file handling |
| CWE-502 | Deserialization of Untrusted Data | 62 | 5% | 4 of 5 | Unsafe deserialization |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | 59 | 5% | 4 of 5 | Injection (SQL, OS command, code, XXE) |
| CWE-20 | Improper Input Validation | 56 | 4% | 3 of 5 | Improper input validation |
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | 43 | 3% | 1 of 5 | Memory safety (overflows, use after free) |
| CWE-306 | Missing Authentication for Critical Function | 41 | 3% | 4 of 5 | Missing or broken authentication and authorization |
| CWE-287 | Improper Authentication | 38 | 3% | 3 of 5 | Missing or broken authentication and authorization |
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | 35 | 3% | 2 of 5 | Injection (SQL, OS command, code, XXE) |
| CWE-843 | Access of Resource Using Incompatible Type ('Type Confusion') | 34 | 3% | 2 of 5 | No family |
How this is calculated
The CWE ids on each CVE CISA confirms exploited (from the CNA's record, else NVD's), counted in the year exploitation was confirmed. A CVE with several CWEs counts once for each. Shares are of CVEs with at least one CWE (1,277 of 1,429 in these years); NVD-CWE-noinfo and NVD-CWE-Other are left out. Names are MITRE's (CWE List version 4.20). "Top ten every year" uses years with at least 20 classified CVEs. Families group CWE ids into patterns a program acts on (lib/cve-analysis/families.ts); a CWE outside every family shows "No family".
Subscriber feature · $5 a month or $50 a year
Read the rest of Chapter 13: Weaknesses that keep coming back
- Do the same weaknesses come back?
- What to ask vendors, and what to configure yourself
- What this means for your program: 4 key points
- 4 program actions mapped to HIPAA and NIST CSF 2.0, starting with “Ask vendors how they rule out the recurring flaw classes”
- Exam angle for 6 CISSP, CISM and CISA domains, with a study prompt
Included with an ExamPrep subscription or as a DueCare site administrator. How linking works