In the 686 entries CISA added to its Known Exploited Vulnerabilities (KEV) catalog from 2024 to 2026 (catalog version 2026.10.08), the most common single weakness is OS command injection, CWE-78, with 45 entries. Injection as a class covers 20.8 percent of entries, ahead of authentication failures at 19.0 percent and memory safety at 16.9 percent. A further 25.7 percent list no CWE or fall outside our five classes.
- 45Entries listing CWE-78, OS command injection, the most common CWESource: CISA KEV catalog, version 2026.10.08
- 20.8%Entries in our injection classSource: CISA KEV catalog, version 2026.10.08
- 25.7%Entries with no CWE or in none of our five classesSource: CISA KEV catalog, version 2026.10.08
- 135Distinct CWE ids across the 686 entriesSource: CISA KEV catalog, version 2026.10.08
Which weaknesses recur most often in exploited vulnerabilities?
The ten most common CWE ids are a mix of old and familiar types. OS command injection (CWE-78) leads with 45 entries. Deserialization of untrusted data (CWE-502) has 39, path traversal (CWE-22) has 35, improper authentication (CWE-287) has 31 and code injection (CWE-94) has 30. Memory errors follow: use after free (CWE-416) has 28 and out-of-bounds write (CWE-787) has 27.
Missing authentication for a critical function (CWE-306) has 23. Command injection (CWE-77) has 19 and improper access control (CWE-284) has 18. Lower in the top 15 are SQL injection (CWE-89) with 17, authentication bypass using an alternate path (CWE-288) and cross-site scripting (CWE-79) with 16 each, improper input validation (CWE-20) with 14 and a general buffer bounds error (CWE-119) with 13.
How do the five weakness classes compare?
Single CWE ids split the picture into many small counts, so we also grouped them into five classes. Injection is the largest. The class groups command, code, SQL, script and expression injection, some of which can lead to remote code execution. Authentication and authorization failures come second. Memory safety comes third. Deserialization and path traversal are close to each other at the bottom.
| Weakness class | Entries | Share of 686 |
|---|---|---|
| Injection (command, code, SQL, script, expression) | 143 | 20.8% |
| Authentication and authorization failures | 130 | 19.0% |
| Memory safety (out-of-bounds, use after free, overflow, type confusion) | 116 | 16.9% |
| Deserialization and unsafe data handling | 66 | 9.6% |
| Path traversal and unsafe file handling | 64 | 9.3% |
| Other or no CWE listed | 176 | 25.7% |
The grouping is our own and heuristic. An entry with CWEs in several classes counts once in each, so the shares add to more than 100 percent. “Other or no CWE listed” holds the entries that sit in none of the five. Exploiting a flaw in an internet-facing product is described in the technique exploit public-facing application. For the product side of the same entries, see KEV additions by product type.
How did the top five change by year?
Command injection (CWE-78) was first in 2024 and 2025. In 2026 code injection (CWE-94) moved to first with 18 entries, and CWE-78 fell to 13. Path traversal (CWE-22) is in the top five in all three years. The two memory errors, use after free and out-of-bounds write, appear in 2024 and 2025 but not in the 2026 top five. Authentication (CWE-287) is in the top five in 2024 and 2026.
| Rank | 2024 (186 entries) | 2025 (245 entries) | 2026 (255 entries) |
|---|---|---|---|
| 1 | CWE-78, OS Command Injection (14) | CWE-78, OS Command Injection (18) | CWE-94, Code Injection (18) |
| 2 | CWE-502, Deserialization (11) | CWE-502, Deserialization (15) | CWE-287, Improper Authentication (16) |
| 3 | CWE-416, Use After Free (10) | CWE-22, Path Traversal (13) | CWE-22, Path Traversal (13) |
| 4 | CWE-22, Path Traversal (9) | CWE-787, Out-of-bounds Write (11) | CWE-78, OS Command Injection (13) |
| 5 | CWE-287, Improper Authentication (9) | CWE-416, Use After Free (11) | CWE-502, Deserialization (13) |
Where counts tie, the order is the order stored in our output. The counts per year are small, so a move of a few entries can change a rank.
How many entries have no CWE?
Of the 686 entries, 644 list at least one CWE and 42 list none. That is 6.1 percent with no CWE at all. The “Other or no CWE listed” group is larger, at 176 entries or 25.7 percent, because it also holds 134 entries that do have a CWE but one that none of our five classes covers.
What does the ransomware-linked list show?
This part covers all years, not only 2024 to 2026. The catalog marks 361 of its 1,739 entries (20.8 percent) as known to be used in ransomware campaigns. Among those entries the most common CWEs are:
- CWE-502, deserialization of untrusted data: 29
- CWE-22, path traversal: 27
- CWE-20, improper input validation: 26
- CWE-287, improper authentication: 16
- CWE-787, out-of-bounds write: 16
- CWE-306, missing authentication for a critical function: 13
- CWE-78, OS command injection: 12
- CWE-94, code injection: 11
The order differs from the 2024 to 2026 list. Deserialization and path traversal are first and second here, and improper input validation is third, while it has 14 entries in the 2024 to 2026 list. OS command injection is first there but seventh here. The two lists cover different periods and different entry sets, so the gap does not show that ransomware operators prefer one weakness. For the ransomware side in full, see KEV ransomware-linked vulnerabilities.
Method
We used the known exploited vulnerabilities catalog from CISA, catalog version 2026.10.08, downloaded on 2026-10-09. We counted entries by the date they were added and kept those added from 2024 to 2026, which gives 686 entries. For each entry we read the CWE field. Each CWE id was counted once per entry. CWE names come from the CVE Program records. We then grouped CWE ids into five classes of our own and counted an entry once in every class it touches.
Limits
The CWE on a KEV entry is the assignment by the CVE numbering authority or NVD, and it can be missing, broad or several at once. Counts of CWE ids say how often a label appears, not how severe the flaw is or how many systems it touched. Our five classes are a heuristic, and another grouping would give other shares. Year counts are small. Nothing here shows why attackers chose a weakness. A fair question for your own review is whether the types at the top of these lists appear in the software you run. For how the CWE Top 25 list is built, see our note on the 2025 CWE Top 25.
For the scoring view of the same catalog, see where KEV entries sit on the EPSS scale.