Source context: this article examines information published by the source on August 26, 2026. This site’s publication date is shown separately. Check the latest vendor guidance before acting.
What was published
On August 26, 2026, CISA released the “Vulnerability Review Fiscal Years 2024 and 2025.” This review analyzes vulnerability data from those two fiscal years to establish a baseline of the current landscape prior to the wider adoption of AI-enabled vulnerability discovery. The publication emphasizes that most compromises stem from basic security failures and the exploitation of exposed, well-known vulnerabilities rather than advanced techniques.
Status and scope
The review is a guidance document intended for a broad audience, including executives, industry partners, and government entities at various levels. Its scope covers the identification of common software weaknesses and the promotion of “Secure by Design” principles to shift from reactive patching toward the proactive elimination of preventable software flaws.
What the guidance covers
The guidance focuses on reducing systemic risk by addressing entire classes of vulnerabilities rather than treating individual CVEs in isolation. A central component is the prioritization framework detailed in Binding Operational Directive 26-04, which evaluates vulnerabilities based on four technical criteria:
* Exposure status: Whether the affected system is accessible to threat actors.
* KEV Catalog status: Whether the vulnerability is listed in the Known Exploited Vulnerability catalog.
* Potential for automated exploitation: The likelihood that the flaw can be exploited via automation.
* Technical impact: The resulting effect on the system if exploited.
How organizations can use it
Vulnerability management teams can integrate these four criteria into their triage process to move away from reliance on generic severity scores. By prioritizing assets based on exposure and known exploitation (KEV), defenders can focus resources on the vulnerabilities most likely to be targeted by threat actors scanning for well-known flaws.
Infrastructure owners can also use the review’s identification of common software weaknesses to evaluate their software supply chain, encouraging a shift toward “Secure by Design” products that eliminate these vulnerability classes at the source.
Decisions and next steps
Our analysis suggests that security leaders should evaluate their current prioritization logic against the BOD 26-04 framework. A primary decision point is whether the organization currently prioritizes based on theoretical severity or actual exploitability and exposure.
To validate the effectiveness of this approach, organizations can perform a gap analysis: compare a list of vulnerabilities patched in the last quarter against the KEV catalog and current external exposure maps. If high-exposure, KEV-listed vulnerabilities remained unpatched while low-exposure, theoretical risks were addressed, the prioritization process requires adjustment.
Limits and open questions
The review provides a baseline based on historical data from FY2024 and FY2025; it does not account for future shifts in exploitation patterns driven by AI. Additionally, while the guidance promotes “Secure by Design” principles, it does not provide a mandatory compliance mechanism for non-federal entities to enforce these standards on software vendors.
Source and editorial note
CISA Vulnerability Review · Source date: August 26, 2026 · Retrieved August 31, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Request a Vulnerability Assessment
Turn security intelligence into action.
Discuss your exposure, priorities, and the evidence needed to validate the outcome.
Request a security assessment ↗