Class elimination compounds in a way patching does not: remove the class and you remove bugs nobody has reported yet [9]. That is the strongest part of CISA's case, and its ceiling is visible in CISA's own number. Subtract the stubborn-weakness share of 41.5% from the catalog and 58.5% of KEV entries sit outside that set [5][17]. Clearing the stubborn classes is worth doing. Most of the exploited catalog still has to be handled one CVE at a time.
The age of the list is the part worth putting to a vendor. MITRE's 2007 standard for an unforgivable vulnerability covered flaws with a documented mistake, an obvious attack path and a trivial exploit [6]. Three of the ten most common CWEs today meet it, which is 30% of the current top ten [7][18]. CISA reads that persistence as a failure of organizational culture and Secure by Design adoption rather than an unsolved engineering problem [8].
The bill is where the review goes quiet. Eliminating memory-safety flaws usually means rewriting large C and C++ codebases in memory-safe languages, which the agency concedes is a multi-year and expensive undertaking [13], and its own summary of the requirement is technical discipline plus executive buy-in [12]. Help Net Security flags a gap the review leaves open: why years of voluntary Secure by Design pledges underdelivered, and why vendors resist owning security outcomes for customers, a phrase that reads as legal liability [14][10].
That leaves procurement as the only enforcement surface on offer. Secure by Demand tells buyers to make security a contract condition and to ask which vulnerability classes a vendor has already eliminated, whether the SBOM is machine-readable, whether phishing-resistant authentication ships on by default, and whether security logs are available [15]. The class question is the one with a falsifiable answer. A vendor that says injection is gone can be held to that the next time an injection CVE appears in its own advisory feed. CISA also tells developers to prioritise weaknesses that attackers exploit together, since many exploited vulnerabilities span multiple categories [11]; the buyer-side version is refusing a roadmap that closes one link in a chain and calls it done.
Set the two findings side by side. Verizon's 2026 report puts vulnerability exploitation as the most common route to initial access [3], and CISA says the vulnerabilities doing that work were known and internet-exposed [2]. Both point at the same operational question: what of yours answers from the internet, and how old is the newest unpatched CVE on it.
