From Weakness to Weaponized: the CWE Classes Attackers Actually Exploit

TL;DR — Not all weakness classes are exploited at the same rate. We took the 1,653 vulnerabilities in CISA KEV (observed exploited in the wild), tallied their CWE weakness types, and compared each type's share of KEV to its prevalence across all 370,431 CVEs in NVD. The gap is an exploitation lift. Type Confusion (CWE-843) is 20.5× over-represented among known-exploited bugs; Deserialization of Untrusted Data (CWE-502) 14.5×; OS Command Injection (CWE-78) 7.4×. Memory-safety classes like Out-of-bounds Write show up in raw counts but carry far lower lift. A reproducible map of which weaknesses to detect first.

The question

A scanner can find thousands of weaknesses. Which classes deserve to be surfaced first? Raw frequency is a poor guide — the most common weakness isn't necessarily the most exploited one. A better guide: among vulnerabilities that are actually exploited, which weakness classes appear far more often than their baseline prevalence would predict? That ratio — call it exploitation lift — points at the classes attackers disproportionately turn into working exploits.

What we counted

• CISA KEV JSON catalog — version 2026.07.24, 1,653 entries; 1,586 carry at least one CWE weakness tag. We tally KEV's CWE mix from these.
• NVD CVE API 2.0 — the baseline. For each CWE, cweId=CWE-nnn returns the total number of CVEs carrying that weakness across all 370,431 published CVEs. That's the prevalence a random CVE would suggest.
• Exploitation lift = (a CWE's share of KEV weakness tags) ÷ (that CWE's share of all CVEs). A lift of 10× means the class is ten times more common among known-exploited vulnerabilities than among CVEs at large.

The result: exploitation lift, ranked

CWE	Weakness class	KEV entries	Lift vs baseline
CWE-843	Type Confusion	37	20.5×
CWE-502	Deserialization of Untrusted Data	69	14.5×
CWE-306	Missing Authentication for Critical Function	38	8.5×
CWE-284	Improper Access Control	34	8.3×
CWE-78	OS Command Injection	106	7.4×
CWE-94	Code Injection	66	4.9×
CWE-416	Use After Free	92	4.3×
CWE-287	Improper Authentication	41	3.2×
CWE-20	Improper Input Validation	118	3.1×
CWE-22	Path Traversal	76	3.1×
CWE-787	Out-of-bounds Write	100	2.0×
CWE-119	Improper Memory Buffer Restriction	84	1.7×

Two things stand out. First, the top of the list is dominated by logic and injection classes — type confusion, deserialization, missing authentication, access control, command and code injection. These are exactly the weaknesses that turn into remote code execution and authentication bypass, and they're over-represented among the exploited by factors of 5× to 20×.

Second, the highest raw counts aren't the highest lift. Out-of-bounds Write (100 KEV entries) and memory-buffer errors (84) appear often in KEV, but they're also extremely common across all CVEs, so their lift is modest (2.0× and 1.7×). Command injection, by contrast, has a comparable KEV count (106) but a much smaller baseline — hence a 7.4× lift. Counting raw appearances would rank memory bugs above injection; measuring lift flips that, and the flip matches where real exploitation concentrates.

Why lift belongs in a detector's priorities

A scanner that treats every weakness class as equally worth surfacing is throwing away public information about what gets weaponized. This ranking is a reproducible prior: findings in high-lift classes — deserialization, injection, missing/improper authentication — deserve to rank above equally-severe findings in low-lift classes. It's one of the reasons Zennoxa Shield's Priority Engine blends observed-exploitation signal (KEV) and probability (EPSS) with severity rather than sorting on severity alone, and why detection effort concentrates on the injection and auth classes at the top of this table. The connection is honest and category-level: the lift figures are computed entirely from public NVD and KEV data, name no vendor, and would hold for any tool.

Reproduce it yourself

1. Download KEV (known_exploited_vulnerabilities.json, version 2026.07.24); tally the cwes field across all entries.
2. For each CWE of interest, query NVD ?cweId=CWE-nnn&resultsPerPage=1 and read totalResults for the baseline count; read the unfiltered totalResults (370,431) for the CVE grand total.
3. Compute each CWE's KEV share and baseline share; divide for lift; sort descending.

Limitations, stated plainly

• Tag-based shares. KEV share is measured over CWE tags in KEV (1,586 tagged entries); baseline share is CVEs-carrying-that-CWE over all CVEs. A CVE can carry multiple CWEs, so shares don't sum to 100% on either side — the lift is a relative prevalence measure, not a partition.
• KEV is a floor. It reflects confirmed exploitation; classes favored by not-yet-public exploitation are undercounted.
• CWE tagging is imperfect. Some CVEs are tagged NVD-CWE-noinfo/Other (excluded here), and mapping granularity varies by class. The ranking is robust to these at the order-of-magnitude level shown, not to the second decimal.

FAQ

Why not just rank by how often a weakness appears in KEV? Because raw frequency conflates "exploited a lot" with "exists a lot." Out-of-bounds Write has one of the highest KEV counts but only 2.0× lift, because it's also everywhere in the CVE population. Lift isolates the classes that are exploited out of proportion to how common they are.

Does a 20× lift mean type confusion is the biggest threat? It means type confusion is the most over-represented class among known-exploited bugs relative to its rarity. Volume matters too — command injection (7.4× lift, 106 KEV entries) is both frequently exploited and highly lifted. Read lift and count together.

How does this help a scanner? It's a prior for ranking. Given two findings of equal severity, the one in a high-lift class (deserialization, injection, missing auth) is empirically more likely to be the kind attackers weaponize, so it should surface first.

What data is this based on? The CISA KEV catalog and NVD CWE counts — both free and reproducible from the pinned snapshots above.