CISA added five older exploited flaws to its KEV catalog on 8 Oct, the same day it joined the FBI, NSA and partner agencies in advisory AA26-281A. Federal civilian agencies must act by 11 Oct; four of the five need forensic triage.
CISA added five older exploited flaws to its KEV catalog on 8 Oct, the same day it joined the FBI, NSA and partner agencies in the UK, Australia, Canada, Japan, New Zealand and Spain in advisory AA26-281A. The advisory says the flaws were among eight exploited CVEs recovered from MicroScan, a scanning tool used by actors it links to China-based Integrity Technology Group. Federal civilian agencies must act by 11 Oct; four of the five need forensic triage. The five are ProFTPD (CVE-2015-3306), ISC BIND (CVE-2015-5477), Apache Struts (CVE-2016-3081), ONLYOFFICE Docs (CVE-2021-3199) and Strapi (CVE-2023-22894); BIND is the one without forensic triage. The advisory describes Integrity Tech as a China-based company with links to the Chinese government, says the activity uses techniques “consistent with” Flax Typhoon, Ethereal Panda and Red Juliett, and notes that vendor naming may not map 1:1 to US government tracking. It lists victims across US critical infrastructure and organisations in Southeast Asia, Africa and North America. KEV lists ransomware use as Unknown on each entry.
Sources: CISA joint advisory AA26-281A (2026-10-08) · CISA Known Exploited Vulnerabilities Catalog (entries dated 2026-10-08)