Among KEV entries added since 2023 that carry a CWE tag, authentication and access control weaknesses cover about 18 percent, memory safety about 17 percent, and command or code injection about 15 percent. No single class dominates. The most common single tag is OS command injection, CWE-78.
Method
We downloaded the CISA KEV JSON feed on 19 October 2026 (catalog version 2026.10.16, 1,748 entries). Each entry has a cwes list. Of the 882 entries added since 1 January 2023, 818 have at least one CWE tag and 64 have none, so we count only the 818.
We grouped CWE IDs into five families. Memory safety: CWE-787, 416, 119, 122, 125, 121, 190, 415, 476. Command or code injection: CWE-78, 77, 94, 95, 917. Authentication and access: CWE-287, 306, 862, 863, 284, 285, 269, 290, 288, 798. Deserialization: CWE-502. Path traversal and file upload: CWE-22, 434, 23.
An entry can carry several tags, so the shares do not add up to 100 percent. CWE tags come from CVE record authors and are sometimes broad, so treat the grouping as a rough lens.
What the numbers say
| Family | All entries | Added since 2023 | Added in 2026 |
|---|---|---|---|
| Memory safety | 23.0% | 17.2% | 14.5% |
| Authentication and access | 13.4% | 17.8% | 20.4% |
| Command or code injection | 14.0% | 15.4% | 14.5% |
| Deserialization | 4.5% | 5.7% | 5.1% |
| Path traversal and file upload | 7.2% | 6.7% | 8.6% |
Whole-catalog numbers lean toward memory bugs because older entries are heavy on desktop software. Since 2023 the balance has moved toward authentication and access flaws, and in 2026 that family is the largest at 20.4 percent of tagged entries (255 entries with tags).
The most common single tags since 2023 are CWE-78 OS command injection (60), CWE-502 deserialization of untrusted data (47), CWE-416 use after free (44), CWE-22 path traversal (40), CWE-94 code injection (40), CWE-287 improper authentication (37), CWE-787 out of bounds write (36) and CWE-306 missing authentication for a critical function (29).
What to do with it
The practical reading is about where to spend review time. Attackers are exploiting bugs that let them run commands or skip a login. Those are often found in internet facing products, which is why exposure matters as much as class.
For teams that build software, three habits map to these families. Treat every code path that builds a shell command or evaluates input as a review hotspot. Make authentication the default on every internal endpoint, because missing authentication appears in the list for a reason. And avoid deserializing data you do not control, or restrict it to a safe format.
For teams that run other people's software, the same list says which patches to take first: remote code execution and authentication bypass fixes on anything reachable from outside.
Quick check
Do memory safety bugs still lead the KEV catalog?
Over the whole catalog, yes, at 23.0 percent of tagged entries. Among entries added since 2023 they are second, at 17.2 percent, behind authentication and access at 17.8.
Why not just use the CVSS score instead?
CVSS describes severity in theory. KEV records exploitation in practice. A weakness family tells you where to look in code, which a score alone does not.
Sources
- CISA Known Exploited Vulnerabilities JSON feed, fetched 19 October 2026
- CISA Known Exploited Vulnerabilities Catalog
Last reviewed: 19 October 2026.
