Topic starter
28/08/2026 12:04 pm
TL;DR: CISA’s FY2024-2025 vulnerability review shows that real-world exploitation remains concentrated in a small set of recurring weaknesses, while the CVE catalog more than doubled from 14,234 to 30,517 in one year, according to Oligo Security’s analysis of CISA data. The implication is that patch prioritisation still matters, but runtime evidence is becoming the decisive control when AI accelerates vulnerability discovery.
Editorial analysis by NHI Mgmt Group, based on content published by Oligo Security: “What CISA's FY2024-2025 Vulnerability Review Means for Runtime Security”.
By the numbers:
- The Known Exploited Vulnerabilities Catalog grew from 1,185 entries to 1,422.
- CISA says 41.5 percent of everything in the KEV Catalog mapped to stubborn weaknesses across FY2024 and FY2025.
- VulnCheck found evidence of active exploitation for 884 vulnerabilities in 2025, while CISA added 245 to KEV.
Key questions
Q: What breaks when vulnerability prioritisation relies on exploitability scores alone?
A: Prioritisation breaks when scores are treated as confirmation rather than signals.
Q: Why does runtime evidence matter more as AI speeds up vulnerability discovery?
A: AI makes new weaknesses appear faster than manual triage can absorb.
Q: How do teams know whether a vulnerability is actually dangerous in production?
A: They confirm whether the vulnerable code runs, whether the path is reachable, and whether the behaviour appears in live execution.
Practitioner guidance
- Prioritise remediation by exploitability evidence Rank vulnerabilities by whether they are reachable, exercised, or already showing exploit-like behaviour in production, not by disclosure volume alone.
- Instrument runtime detection around high-risk weaknesses Monitor execution paths for injection, traversal, and authentication failures so teams can see when a flaw is actually being exercised.
- Use KEV as the minimum threshold for action Treat KEV inclusion as the floor for remediation urgency, then layer internal telemetry and asset context on top to find the exposures KEV does not capture.
Bottom line: CISA’s review shows that the most dangerous vulnerabilities are not evenly distributed across the CVE catalog. They cluster around a small set of recurring weaknesses that keep reappearing in real compromises.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
28/08/2026 12:04 pm
Runtime evidence is becoming the decisive governance signal. CISA’s review shows why disclosure volume alone no longer tells practitioners what to fix first. When the catalog expands faster than remediation capacity, governance must shift from counting vulnerabilities to proving exploitability in production. For identity and access programmes, the same logic applies to secrets and service-account exposure. Practitioners should treat runtime proof as part of the control plane, not an after-the-fact detection layer.
A question worth separating out:
Q: What should teams do when a weakness is not yet in KEV but appears exploitable?
A: Treat it as a live exposure problem. Contain the reachable path, add runtime monitoring around the affected function, and move the item ahead of lower-risk tickets even if it has not been formally confirmed in a vulnerability catalog.
👉 Read our full editorial: CISA’s vulnerability review shows why runtime security now matters