CISA Publishes FY24-25 Vulnerability Landscape Review
CISA's Vulnerability Review analyzes FY2024-2025 data to highlight root-cause software weaknesses and a risk-based prioritization framework under BOD 26-04.
Sourcecisa.gov — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
CISA released a Vulnerability Review report analyzing agency and open-source vulnerability data from fiscal years 2024 and 2025 to establish a baseline understanding of the current vulnerability landscape, particularly ahead of anticipated shifts driven by AI-enabled vulnerability discovery. The report emphasizes that most successful compromises stem not from sophisticated tradecraft but from opportunistic exploitation of well-known, unpatched vulnerabilities exposed to the internet, underscoring persistent gaps in basic security hygiene across organizations.
The review promotes Secure by Design principles, urging software producers to address recurring classes of software weaknesses at the root rather than patching individual vulnerabilities reactively. It identifies common weakness patterns contributing to exploitable flaws and provides guidance for eliminating entire vulnerability classes through improved development practices. This systemic approach is intended to reduce the overall attack surface available to opportunistic threat actors who rely on internet-wide scanning to find exposed, exploitable systems.
Additionally, the report operationalizes the prioritization framework from Binding Operational Directive 26-04, which evaluates vulnerabilities using four criteria: internet exposure status, presence in CISA's Known Exploited Vulnerabilities (KEV) Catalog, potential for automated/mass exploitation, and technical impact. This framework is intended to help defenders triage remediation efforts based on real-world risk rather than treating all vulnerabilities as equally urgent. The document is informational/policy guidance rather than an alert on a specific active threat.
Source reporting: https://www.cisa.gov/resources-tools/resources/cisa-vulnerability-review
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs