CISA Vulnerability Review FY2024–2025: Why Known, Exposed Vulnerabilities Still Drive Most Compromises — A Defender's Prioritization Guide

CISA's newly published Vulnerability Review, drawn from CISA and open-source data across fiscal years 2024 and 2025, lands on a conclusion that most of us in incident response have been stating anecdotally for a decade: the majority of compromises do not involve advanced techniques, bespoke tooling, or zero-day exploits. Threat actors scan the internet at scale, find exposed services running software with well-known, already-patched vulnerabilities, and walk in through the front door.

The review matters for two reasons. First, it establishes a data-driven baseline of today's vulnerability landscape before AI-enabled vulnerability discovery becomes widespread — meaning the window in which defenders can outpace attackers on known flaws is about to shrink dramatically. Second, it points the finger at root causes: insecure software design decisions and basic security hygiene failures, not defender incompetence in the face of unstoppable adversaries.

For SOC leaders and vulnerability management teams, the operational takeaway is blunt: if your prioritization model is still driven by raw CVSS scores or scan-count SLAs, you are optimizing for the wrong thing. Risk-based prioritization — exploitability evidence, internet exposure, and CISA KEV presence — is what actually reduces compromise probability.

Technical Analysis

What the Review Actually Says

The CISA Vulnerability Review analyzes vulnerability data from FY2024 and FY2025 to identify the root causes of insecure software and provide practical remediation guidance. Its core findings, as described in the release:

• Most compromises exploit known, exposed weaknesses. Cyber threat actors continuously scan the internet for internet-facing services running software with publicly documented vulnerabilities. They do not need novel capability — they need your patch latency to exceed their scan interval.
• Basic security failures enable the majority of intrusions. Default configurations, missing patches on edge devices, exposed management interfaces, and unsegmented flat networks are the enabling conditions, not exotic attack chains.
• Prioritization must be risk-based. Organizations that attempt to patch everything at equal priority end up patching nothing effectively. The review explicitly recommends prioritizing vulnerabilities based on the risk they pose — real-world exploitation evidence and exposure context, not theoretical severity.
• This is a pre-AI baseline. CISA is candid that this review captures the landscape before AI-enabled vulnerability discovery scales up. When AI-assisted bug hunting increases the volume of weaponizable findings, organizations without mature prioritization and rapid remediation pipelines will fall further behind.

The Defender's View of the Attack Chain

The campaign pattern CISA describes is mechanically simple and highly repeatable:

1. Reconnaissance at scale. Actors (criminal and state-sponsored alike) run continuous internet-wide scans — their own infrastructure or commercial scan data — fingerprinting software versions on exposed services: VPN concentrators, firewalls, remote access gateways, web applications, and management interfaces.
2. Matching exposure to known exploits. Identified versions are cross-referenced against public exploit code, proof-of-concepts, and KEV-listed vulnerabilities. For KEV entries, working exploit code almost always exists in the wild.
3. Initial access via the exposed service. Exploitation typically yields code execution in the context of the web or edge service process — frequently followed by the service process spawning shells, downloaders, or webshells. This is the highest-fidelity detection point.
4. Post-exploitation. Credential access, lateral movement, and persistence follow — but by this stage you are doing incident response, not prevention.

The entire model collapses if step 2 finds nothing: no exposed vulnerable services, no initial access. That is the strategic point of the review.

Exploitation Status

This is not a single-CVE story. The review is a landscape assessment. However, its premise rests on confirmed, at-scale in-the-wild exploitation of known vulnerabilities — the same population of flaws tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog, which carries binding remediation deadlines for federal civilian agencies and serves as the de facto prioritization list for the private sector. Treat any KEV-listed vulnerability present on an internet-facing asset as an active incident risk, not a backlog item.

Detection & Response

Because this threat model centers on exploitation of internet-facing services, the most reliable endpoint telemetry is anomalous child process execution from web, VPN, and edge service processes — the universal signature of a service exploit landing, regardless of which CVE was used. Network-side, watch for inbound scanning and exploitation probing against exposed services.

---
title: Web or Edge Service Process Spawning Shell or Script Interpreter
id: 3f9c1a72-5b84-4d61-9e27-8c2a4f6b1d90
status: experimental
description: Detects web server, VPN, or edge service processes spawning shells or script interpreters — a high-fidelity indicator of successful exploitation of an internet-facing service via a known vulnerability, consistent with the mass-scanning/exploitation pattern described in the CISA Vulnerability Review.
references:
  - https://www.cisa.gov/resources-tools/resources/cisa-vulnerability-review
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\tomcat9.exe'
      - '\java.exe'
      - '\php-cgi.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate application-server administrative scripts; tune by ParentImage command line and application pool identity
level: high
---
title: Linux Web Service Process Spawning Shell or Download Utility
id: 8e2b5d14-6a93-4c58-bf31-1d7e9a3c4b26
status: experimental
description: Detects Linux web or edge service daemons spawning interactive shells, download utilities, or base64-decoding pipelines — consistent with post-exploitation behavior following compromise of an internet-facing service via a known vulnerability.
references:
  - https://www.cisa.gov/resources-tools/resources/cisa-vulnerability-review
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/nginx'
      - '/apache2'
      - '/httpd'
      - '/php-fpm'
      - '/java'
      - '/node'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/perl'
  condition: selection_parent and selection_child
falsepositives:
  - Application health checks and deployment pipelines invoking curl/wget from service context; baseline per host role
level: high

// Hunt: inbound scanning and exploitation probing against internet-facing services
// Surfaces high-volume source IPs hitting edge services plus edge process anomalies
// Tables: CommonSecurityLog (firewall/edge CEF ingestion), DeviceProcessEvents

// Part 1 — High-volume inbound connection sources against edge/VPN/web services
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceAction in ("allow", "allowed", "Accept") or isnull(DeviceAction)
| where DestinationPort in (443, 8443, 10443, 4443, 8080, 80, 22)
| summarize ConnectionCount = count(),
            DistinctDestinations = dcount(DestinationIP),
            DistinctPorts = dcount(DestinationPort)
    by SourceIP, bin(TimeGenerated, 1h)
| where ConnectionCount > 500 or DistinctDestinations > 50
| sort by ConnectionCount desc;

// Part 2 — Edge/web service processes spawning suspicious children (Windows estates via Defender)
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName in~ ("w3wp.exe", "httpd.exe", "nginx.exe", "tomcat9.exe", "php-cgi.exe", "java.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe", "wscript.exe", "cscript.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, ReportId
| sort by TimeGenerated desc

-- Hunt for web/edge service processes spawning shells or downloaders
-- Run across DMZ and internet-facing hosts to surface exploitation of exposed services
SELECT Pid,
       Ppid,
       Name,
       Exe,
       CommandLine,
       Username,
       CreateTime,
       dict(Name=parent.Name, Exe=parent.Exe) AS Parent
FROM pslist()
WHERE (Exe =~ '(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|mshta\.exe|certutil\.exe|/bin/(ba)?sh|/usr/bin/(curl|wget|nc|ncat))')
  AND (dict(Name=parent.Name).Name =~ '(?i)(w3wp|httpd|nginx|apache2|php-fpm|tomcat|java|node)')
LET parent <= SELECT Name, Exe FROM pslist(pid=Ppid)

#!/bin/bash
# attack_surface_audit.sh
# Baseline audit of internet-exposed services on a Linux edge/web host.
# Goal: identify listening services, exposed management interfaces, and pending
# security updates — the conditions CISA's Vulnerability Review identifies as
# the root enablers of most compromises.

echo "=== [1] Listening TCP/UDP services bound to non-localhost interfaces ==="
ss -tulpn | grep -Ev '127\.0\.0\.1|\[::1\]' || netstat -tulpn 2>/dev/null | grep -Ev '127\.0\.0\.1'

echo ""
echo "=== [2] High-risk management interfaces exposed (should be NONE on public interfaces) ==="
# 22=SSH, 2323=telnet-alt, 3389=RDP-proxy, 5900=VNC, 8080/8443=admin consoles, 10000=Webmin
ss -tlnp | grep -E ':(22|23|3389|5900|8080|8443|10000)\b' || echo "None found on this host."

echo ""
echo "=== [3] Pending security updates ==="
if command -v apt >/dev/null 2>&1; then
    apt list --upgradable 2>/dev/null | grep -i secur || echo "No pending security updates flagged."
elif command -v dnf >/dev/null 2>&1; then
    dnf updateinfo list security 2>/dev/null || echo "No pending security updates flagged."
elif command -v yum >/dev/null 2>&1; then
    yum updateinfo list security all 2>/dev/null | head -50
fi

echo ""
echo "=== [4] Service versions for KEV cross-reference (compare against CISA KEV catalog) ==="
for svc in nginx apache2 httpd openvpn; do
    if command -v $svc >/dev/null 2>&1; then
        echo -n "$svc: "; $svc -v 2>&1 | head -1
    fi
done
openssl version 2>/dev/null
ssh -V 2>&1

echo ""
echo "=== ACTION: Cross-reference the versions above against https://www.cisa.gov/known-exploited-vulnerabilities-catalog ==="
echo "=== Any KEV match on an internet-facing service = remediate immediately per KEV due date ==="

Remediation

The review's prescription is process-level, not patch-level. Implement it as follows:

1. Adopt KEV-driven prioritization immediately. Pull the CISA KEV catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) into your vulnerability management platform via its JSON/CSV feed or API. Any KEV entry present on an internet-facing asset jumps the queue ahead of any CVSS 9.8 with no exploitation evidence. Federal agencies operate under Binding Operational Directive 22-01 remediation timelines; treat those due dates as your own internal SLA benchmark — typically two weeks for most entries, and far less for edge devices.

2. Enumerate and reduce your external attack surface. Run authenticated external scans — and your own continuous attack surface management — against every public IP range, cloud tenancy, and subsidiary domain you own. The specific question to answer weekly: what software and version is listening on every internet-facing port, and does it have a KEV entry or public exploit? Decommission or ACL anything that does not need to be public. Management interfaces (firewall/VPN admin portals, remote desktop gateways, IPMI/iDRAC/iLO) must never be internet-reachable.

3. Compress patch latency on the perimeter tier. Edge devices (VPN concentrators, firewalls, secure email/web gateways, load balancers) are the highest-value targets in the scan-and-exploit model and historically the slowest patched. Establish a separate, aggressive SLA for this tier — 72 hours for KEV-listed flaws is a defensible starting target — with pre-approved maintenance windows so process cannot delay patching.

4. Close the basic hygiene gaps the review calls out. Remove default credentials, disable unused services and protocols, enforce MFA on all remote access, and segment so that a compromised edge service cannot reach domain controllers or crown-jewel data stores. These are CIS Controls 1–6 fundamentals — unglamorous, and exactly what stops the majority of compromises.

5. Deploy behavioral detection on exposed services. Even with aggressive patching, there will be gaps. The web/edge-service-spawning-shell detections above catch exploitation independent of the specific CVE used — critical insurance as AI-enabled vulnerability discovery increases the tempo of exploit development.

6. Demand secure-by-design from vendors. The review traces root causes to insecure software development decisions. In procurement and renewal cycles, require vendors to demonstrate alignment with CISA's Secure by Design principles — memory-safe languages, elimination of default passwords, and published vulnerability disclosure policies. Your vulnerability backlog is, in large part, your vendors' engineering debt.

Executive Takeaways

• Your biggest risk is not the zero-day — it is the known CVE you have not patched on an exposed system. Re-baseline your vulnerability program metrics around KEV presence and internet exposure, not CVSS distributions.
• Patch latency on perimeter devices is your single most important KPI. Measure it, report it to the board, and resource against it.
• Attack surface reduction beats detection volume. Every service removed from the internet is a compromise that cannot happen and an alert that never needs triage.
• Prepare for the AI-era vulnerability flood now. CISA explicitly frames this review as the pre-AI baseline. Organizations without automated KEV ingestion, exposure context, and rapid remediation pipelines will be structurally unable to keep pace when AI-assisted discovery accelerates exploit availability.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub