On 8 October 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. All five are old: the oldest, a ProFTPD flaw, dates to 2015, and the newest, a Strapi flaw, was disclosed in 2023. The same day, CISA, the FBI and the NSA published a joint cybersecurity advisory, AA26-281A, that lists all five among eight exploited flaws and marks them as newly added to KEV.
The advisory was co-authored by the FBI, CISA and NSA with the UK National Cyber Security Centre, the Australian Signals Directorate’s Australian Cyber Security Centre, the Canadian Centre for Cyber Security, Japan’s National Police Agency and National Cybersecurity Office, the New Zealand National Cyber Security Centre, and Spain’s Centro Nacional de Inteligencia. It says Integrity Technology Group, a China-based company with links to the Chinese government, enables China-linked threat actors to exploit organizations in the U.S. and elsewhere.
Cowry Tech News makes no attribution of its own. Every statement below about who did what is the advisory’s, and we keep its hedges. The KEV entries themselves name no actor. The advisory does.
The KEV due date, 11 October 2026, binds Federal Civilian Executive Branch (FCEB) agencies only. Everyone else may use the catalog voluntarily.
What joint advisory AA26-281A says
The advisory says the actors it describes use large-scale botnets, VPN infrastructure, living-off-the-land techniques and repositories of exploitation tools, and that they combine automated scanning with hands-on exploitation to steal sensitive data. It describes Integrity Technology Group as a for-profit company whose employees acquire or build cyber tools, host infrastructure and compromise networks.
The advisory hedges its naming. The actors enabled by Integrity Tech, it says, use techniques “consistent with” the activity publicly known as Flax Typhoon, Ethereal Panda and Red Juliett, among others. It adds that these actors may also perform activity not associated with the company, and that security companies track actors differently, so those names may not match the U.S. government’s own tracking one to one.
On targets, the advisory says the actors targeted victims across U.S. critical infrastructure sectors, including government services and facilities, critical manufacturing, healthcare and public health, and information technology. It says they also targeted U.S. law enforcement, education and religious organizations, and organizations across Southeast Asia, Africa and North America. We state that as the advisory states it. We have no independent victim information, and the advisory’s CVE table does not tie individual flaws to individual victims.
The press release adds that these actors target edge devices that organizations do not monitor closely, and the advisory says they focus their scanning on ports for FTP, SSH, DNS, HTTP, HTTPS and SOCKS. Two of the products below are an FTP server and a DNS server.
How the five KEV CVEs appear in AA26-281A Appendix B
Appendix B of the advisory, Table 16, is titled “Successfully Exploited CVEs” and lists eight. In its MicroScan section, the advisory says Appendix B lists exploited CVEs recovered from penetration testing scripts in that application. An asterisk marks the CVEs newly added to KEV, and five carry it: ProFTPD, BIND, Struts, ONLYOFFICE Docs and Strapi. The other three are CVE-2014-6278 (GNU Bash), CVE-2019-11510 (Pulse Connect Secure) and CVE-2021-22205 (GitLab). They carry no asterisk because they were already in the catalog: the feed shows Bash added on 2025-10-02 and the other two on 2021-11-03. We leave them out of the rest of this story.
What CISA added on 8 October
The feed shows the five entries this way.
| CVE | Vendor / product | KEV name | CWE | Forensic triage | Ransomware use |
|---|---|---|---|---|---|
| CVE-2015-3306 | ProFTPD | ProFTPD Improper Access Control Vulnerability | CWE-284 | Yes | Unknown |
| CVE-2015-5477 | ISC BIND | ISC BIND Data Processing Errors Vulnerability | CWE-19 | No | Unknown |
| CVE-2016-3081 | Apache Struts | Apache Struts Command Injection Vulnerability | CWE-77 | Yes | Unknown |
| CVE-2021-3199 | ONLYOFFICE Docs | ONLYOFFICE Docs Server Path Traversal Vulnerability | CWE-22 | Yes | Unknown |
| CVE-2023-22894 | Strapi | Strapi Cleartext Storage of Sensitive Information Vulnerability | CWE-312 | Yes | Unknown |
All five were added on 2026-10-08 with a due date of 2026-10-11, a Sunday and three days later. The required action is the same on each: apply mitigations per vendor instructions and BOD 26-04, or stop using the product if mitigations are unavailable.
The ransomware field reads “Unknown” on all five. That means CISA has no information tying these entries to ransomware campaigns. We make no ransomware claim about any of them.
Who the due date binds
BOD 26-04, “Prioritizing Security Updates Based on Risk,” was issued on 10 June 2026 and replaced BOD 19-02 and BOD 22-01. It applies to FCEB agencies. CISA’s text excludes national security systems, and it does not reach contractors unless the procurement contract says so. If you are not an FCEB agency, nothing in the directive makes 11 October your deadline. You can still treat it as a benchmark, since CISA adds a vulnerability only with reliable evidence of exploitation in the wild. CISA’s FAQ adds that an older CVE can qualify at any time, whatever its age, if it meets four conditions: an assigned CVE ID, that evidence, clear remediation or mitigation, and significant risk to U.S. government systems. It also says an addition does not necessarily mean CISA is observing exploitation right now.
Why 2015 to 2023 flaws get a three-day clock
Why is a 2015 BIND denial of service on a three-day timer in 2026? CISA’s implementation guidance says: “CISA does not assume that all running legacy products are fully patched.” It also does not assume agencies have decommissioned every end-of-life asset, and it says actors will keep exploiting a legacy product with a known exploited flaw until it is remediated or mitigated.
The point is inventory. A flaw patched in 2015 stays dangerous on any host that never got the patch, and those hosts are the ones nobody looks at: a departmental FTP box, a DNS server a contractor set up, a document editor that grew an internet-facing port.
What forensic triage means under BOD 26-04
For four of the five entries the feed says forensic triage is required. BOD 26-04 defines the phrase. Where a timeline is marked “& forensic triage,” the agency must finish remediation or mitigation within the timeline, three days in this case, and also triage the asset to assess whether it is compromised.
Patching and checking are separate jobs: patching a compromised server closes the door and leaves the attacker inside. CISA’s implementation guidance lays out six steps: scoping, evidence collection, critical patching, containment, triage analysis and an escalation decision. It gives target windows between two and 72 hours from the KEV addition, and says the windows are recommended practice. The requirement is an adequate triage. Evidence collection comes before patching because patching can destroy artifacts, and containment is coordinated with collection because premature containment can destroy evidence and tip off an attacker. The final report ends in one of three outcomes: no evidence of compromise, confirmed compromise, or suspected compromise that needs more work.
A private operator does not have to follow the sequence, but the logic carries over: take the image or the logs before you patch, write down what you checked, and decide ahead of time who can declare an incident. The advisory’s authors urge defenders to hunt for compromises.
BIND is the exception in the table. The KEV entry lists forensic triage as “No” for CVE-2015-5477. ISC’s advisory describes a crash: a crafted packet makes the name server exit. CISA’s guidance classes denial of service as partial control. We read the “No” as consistent with that, though CISA does not explain its reasoning on individual entries.
ProFTPD: CVE-2015-3306
NVD puts the flaw in the mod_copy module in ProFTPD 1.3.5. Remote attackers can read and write arbitrary files with the SITE CPFR and SITE CPTO commands. NVD scores it 10.0 under CVSS 3.1. A Gentoo security bug tracks it as affecting versions before 1.3.5a and is marked resolved and fixed.
The exposure is tied to one module, so the first check on a ProFTPD host is the running version and whether mod_copy is present. The capability is a read and write primitive limited by what the ProFTPD process account can touch, and where that account can write into a web root or a cron directory, a file-copy bug is a short step from code execution.
The fix, from what we could retrieve: upgrade to 1.3.5a or later, or to your distribution’s patched package, and confirm its changelog names CVE-2015-3306. The ProFTPD site and a Debian announcement linked from the KEV notes returned nothing usable when we fetched them.
For triage, preserve the FTP logs and filesystem state before patching, search the logs for SITE CPFR and SITE CPTO commands, and look in writable directories for files no deployment put there.
ISC BIND: CVE-2015-5477
ISC’s advisory AA-01272, which the KEV notes link through an Internet Archive copy, describes an error in the handling of TKEY queries. A constructed packet triggers a REQUIRE assertion failure and named exits. Recursive and authoritative servers are both affected. ISC rated it critical, listed no workarounds, and said no active exploits were known when it published in July 2015. Exposure is not prevented by ACLs or by configuration options that limit service, because the exploitable code runs early in packet handling, before those checks.
Affected versions are BIND 9.1.0 through 9.8.x, 9.9.0 through 9.9.7-P1, and 9.10.0 through 9.10.2-P2. The fixed releases are 9.9.7-P2 and 9.10.2-P3, and NVD agrees. ISC patches only supported versions, so a server on 9.8 or older has no fix in this advisory and needs a move to a supported release.
Packages complicate version checks: Red Hat’s RHSA-2015:1513 shipped a backported patch for RHEL 6 and 7, so an old-looking version can include the fix. Check your distribution’s advisory. The failure is quiet. A supervisor that restarts a crashed named makes the outage look like a blip, so search DNS logs for assertion failures and unexplained exits. With no triage requirement in the feed, treat this one as an availability problem first.
Apache Struts: CVE-2016-3081
Apache’s bulletin S2-032 describes remote code execution through the method: prefix when Dynamic Method Invocation is enabled. It recommends disabling Dynamic Method Invocation if possible, or upgrading to Struts 2.3.20.3, 2.3.24.3 or 2.3.28.1. It lists affected software as Struts 2.3.20 through 2.3.28, except 2.3.20.3 and 2.3.24.3. NVD and the joint advisory give the ranges 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1 and 2.3.25 to 2.3.28.
Apache expects no compatibility problems moving to the fixed versions, and its workaround is to disable Dynamic Method Invocation. Struts rarely sits where its owner can see it: it is compiled into a WAR file, packaged by a vendor, and deployed to a server whose administrator may never have opened the archive. Search for Struts core library files, record versions, and find the Dynamic Method Invocation setting in the configuration.
For triage, treat an internet-facing server that ran an affected version with the feature on as potentially compromised until the logs say otherwise. Preserve web and application server logs and look for requests that carry the method: prefix. The advisory’s own mitigations include reviewing web application access logs for traversal, command injection and enumeration attempts.
ONLYOFFICE Docs: CVE-2021-3199
NVD describes a directory traversal with remote code execution in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a “/..” sequence in an image upload parameter. NVD lists CVSS 3.1 scores of 9.8 on both of its entries. The joint advisory lists the affected range as 5.1.5 through 5.6.2.
The vendor record we retrieved is the project changelog, which the KEV notes link. Version 5.6.3 lists “Fix Path Traversal vulnerability via image upload params.” Version 5.6.2 fixes a traversal through a savefile parameter and 5.6.1 fixes one through a Convert Service parameter, so a server on an early 5.6.x build is missing a run of fixes. Our reading is that anyone on this branch should be well past 5.6.3. We retrieved no standalone vendor advisory and did not verify the current release, so 5.6.3 is a floor and not a target.
Document Server is often a back-end service for another application, so look for it by port and process. For triage, preserve upload and server logs and review recently written files, especially outside the directories the application normally writes to.
Strapi: CVE-2023-22894
NVD says Strapi through 4.5.5 lets attackers with admin panel access discover sensitive user details through the query filter. With super admin access, the description says, this can expose password hashes and password reset tokens for all users.
Strapi’s disclosure post, which the KEV notes link, lists affected versions as 3.2.1 up to but not including 4.8.0 and tells users to update to 4.8.0 or later. It says Strapi 3.x reached end of life on 31 December 2022 and gets no patch for this flaw. Its timeline says the researcher later found a way to exploit the flaw as an unauthenticated user, and that chaining it with CVE-2023-22621 gave unauthenticated remote code execution on Strapi 4.5.5 and earlier. CVE-2023-22621 is fixed in 4.5.6, according to the same post. The KEV entry matches: it flags possible end of life and names the chain. On 3.x there is no patch, so the plan is migration to a maintained 4.x release.
The vendor post says exploitation shows up in request logs and gives a search pattern, which we do not reproduce. Read the post and run it against your own logs. If you keep none for the admin panel, you cannot rule this out.
How to find forgotten servers: inventory, version checks, exposure
Start from exposure, not from the application list. CISA’s implementation guidance names ways to discover assets: active scanning with Nmap, CISA’s Cyber Hygiene service, passive network discovery, endpoint detection and response, network access control, and cloud provider inventories. The joint advisory points the same way. It recommends disabling unused services and ports, configuring applications to reveal as little as possible in login pages and banners, considering attack surface management, and replacing end-of-life products.
Then check versions, one product at a time.
- ProFTPD: version, and whether mod_copy is present.
- BIND: ask the binary for its version, compare it to ISC’s fixed releases and your distribution’s advisory, and cover any appliance that embeds BIND.
- Struts: find the library files inside deployed archives, record versions, and check whether Dynamic Method Invocation is enabled.
- ONLYOFFICE Docs: find the Document Server service and compare its version to 5.6.3.
- Strapi: record the version from the project’s package file and whether the admin panel is reachable from outside. Any 3.x install is a migration item.
Give each result an owner. If a managed service provider runs the host, ask in writing for the version, the change date and whether they checked for compromise. If you cannot patch in three days, the directive says removing a system from the internet is a valid mitigation. For a forgotten FTP server, that is often the fastest honest answer.
BOD 26-04 prioritization basics
The directive replaces ranking by CVSS label with a table of timelines. CISA’s text names four variables: asset exposure, KEV status, whether an adversary can automate every step of exploitation, and whether exploitation gives partial or total control of the asset. The guidance gives one worked example: a publicly exposed asset, total technical impact and an automatable flaw produce a three-day KEV due date. The timelines are maximums, and CISA’s FAQ says agencies may patch faster.
The remediation table is published as a figure on CISA’s page and we could not read it as text, so we do not restate it. The directive also phases its requirements, with the remediation timelines in a third phase due within 180 days of issuance. We did not verify how CISA applies that phasing to today’s due dates.
What we do not know
The KEV entries do not say who exploited these flaws or how many systems were affected. The advisory attributes activity as described above, and we report that as its claim. The KEV ransomware field is “Unknown” on all five and we leave it there.
One public indicator of likelihood is the FIRST Exploit Prediction Scoring System. For 8 October 2026, the FIRST EPSS API returns these probabilities: ProFTPD CVE-2015-3306 at 96.8 percent, Struts CVE-2016-3081 at 93.4 percent, BIND CVE-2015-5477 at 91.3 percent, ONLYOFFICE CVE-2021-3199 at 8.2 percent, and Strapi CVE-2023-22894 at 1.7 percent. EPSS is a statistical model, not an observation of exploitation. A KEV listing already tells you to act, and a low number on the two newest entries is no reason to wait.
Outlook
CISA’s guidance says it will add indicators or forensic guidance to a KEV entry when it has them, so the entry notes on these five, and the advisory’s own indicator files, are where a triage team should look first. For the weekend: list every host that runs one of the five products, mark which answer from the internet, take evidence before you patch where triage applies, and upgrade or remove the service.
Related reading
Sources and method
- Joint advisory (lead primary): AA26-281A, “Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data,” 8 October 2026, co-authored by FBI, CISA, NSA, UK NCSC, Australia’s ACSC, Canada’s Cyber Centre, Japan’s NPA and NCO, New Zealand’s NCSC and Spain’s CNI: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a (PDF copy checked at https://www.ic3.gov/CSA/2026/261008.pdf)
- Press release: CISA, FBI, NSA and International Partners Warn of China-based Cybersecurity Company Enabling Threat Actors to Target Multiple Critical Infrastructure Sectors Worldwide, 8 October 2026: https://www.cisa.gov/news-events/news/cisa-fbi-nsa-and-international-partners-warn-china-based-cybersecurity-company-enabling-threat
- KEV data: CISA Known Exploited Vulnerabilities JSON feed, catalog version 2026.10.08, 1,739 entries: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
- Directive: BOD 26-04, Prioritizing Security Updates Based on Risk, 10 June 2026: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- Implementation guidance: BOD 26-04 Implementation Guidance: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- NVD records for the five CVEs, retrieved through the NVD CVE API 2.0 on 9 October 2026: https://nvd.nist.gov/vuln/detail/CVE-2015-3306 (same path for the other four)
- ISC: advisory AA-01272 (Internet Archive copy): https://web.archive.org/web/20150729014733/https://kb.isc.org/article/AA-01272
- Red Hat: RHSA-2015:1513: https://access.redhat.com/errata/RHSA-2015:1513.html
- Apache Struts: Security Bulletin S2-032: https://cwiki.apache.org/confluence/display/WW/S2-032
- ONLYOFFICE: Document Server changelog, entries 5.6.1 to 5.6.4: https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md
- Strapi: Security Disclosure of Vulnerabilities: CVE-2023-22893, CVE-2023-22621, and CVE-2023-22894: https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve
- ProFTPD: Gentoo Security bug 546644: https://bugs.gentoo.org/show_bug.cgi?id=CVE-2015-3306
- EPSS: FIRST EPSS API, values dated 2026-10-08: https://api.first.org/data/v1/epss
- Not retrieved: proftpd.org and the Debian security announcement named in the KEV notes.
No indicators of compromise, victim counts or exploit steps are reproduced. All attribution is the advisory’s; CTN makes none. The due date binds FCEB agencies only; the KEV ransomware field is stated as “Unknown”.