Notifications
Clear all
Topic starter
28/08/2026 12:04 pm
TL;DR: CISA’s FY2024-2025 vulnerability review shows that real-world exploitation remains concentrated in a small set of recurring weaknesses, while the CVE catalog more than doubled from 14,234 to 30,517 in one year, according to Oligo Security’s analysis of CISA data. The implication is that patch prioritisation still matters, but runtime evidence is becoming the decisive control when AI accelerates vulnerability discovery.
NHIMG editorial — based on content published by Oligo Security: What CISA's FY2024-2025 Vulnerability Review Means for Runtime Security
By the numbers:
- Across FY2024 and FY2025, 41.5 percent of everything in the KEV Catalog mapped to stubborn weaknesses that have appeared on MITRE’s most-dangerous list every year since at least 2019.
- VulnCheck found evidence of active exploitation for 884 vulnerabilities in 2025, while CISA’s KEV Catalog added 245 that same year.
- VulnCheck had evidence of exploitation before CISA added the matching CVE to KEV more than 85 percent of the time in 2025.
Questions worth separating out
Q: What breaks when known vulnerabilities are not validated at runtime?
A: Teams lose the ability to distinguish theoretical exposure from exploitable exposure.
Q: Why do repeat CWE classes keep causing breaches even when teams know about them?
A: Because the failure is usually operational, not informational.
Q: How do security teams know if CVE prioritisation is actually working?
A: CVE prioritisation is working when teams can consistently separate theoretical exposure from actionable risk.
Practitioner guidance
- Prioritise exploitability over CVSS Build remediation queues around exposed assets, reachable code paths, and confirmed exploit patterns instead of treating severity scores as the main decision input.
- Map repeat CWEs to control owners Assign SQL injection, command injection, code injection, path traversal, and missing authentication findings to specific engineering and IAM control owners.
- Use runtime enforcement as a compensating control Where patching windows are long, block malicious behaviour at execution time and verify that the control does not break legitimate application flows.
What's in the full article
Oligo Security's full analysis covers the operational detail this post intentionally leaves at the source:
- CWE-by-CWE breakdown of how runtime detection distinguishes exploitable paths from theoretical findings
- Practical examples of how the vendor blocks malicious behaviour without taking down production systems
- Detailed explanation of where CISA’s KEV list stops and why runtime evidence is needed beyond it
- Implementation context for teams that need to prioritise vulnerabilities before patch windows close
👉 Read Oligo Security’s analysis of CISA’s FY2024-2025 vulnerability review →
CISA’s vulnerability review: what it means for runtime security teams?
Explore further
28/08/2026 12:04 pm
Runtime exploitability is becoming the real control boundary. CISA’s review reinforces that catalog size is not the same as business risk. What matters is whether a weakness is actually reachable, executable, and exploitable in production. For identity and access teams, that means runtime evidence increasingly determines whether a control gap is real or theoretical. The practitioner conclusion is simple: vulnerability management now depends on enforcement, not just inventory.
A question worth separating out:
Q: Who should own remediation when compliance software finds overprivileged access?
A: The entitlement owner, not the compliance tool, should own the decision and the follow-through. Compliance platforms can flag issues and track status, but they cannot replace business accountability for reducing access or removing it entirely.
👉 Read our full editorial: CISA’s vulnerability review shows why runtime security now matters
