Five old flaws added to CISA exploited list in seven-nation warning
CISA has added five vulnerabilities in widely used open-source software to its Known Exploited Vulnerabilities catalog, giving federal agencies just three days, until 11 October 2026, to patch or decommission affected systems. The move is tied to a joint advisory from seven nations attributing active exploitation to Chinese state-linked actors associated with Integrity Technology Group.
The five flaws
The flaws are CVE-2015-3306 in ProFTPD (CVSS 10.0), CVE-2021-3199 in ONLYOFFICE Docs (9.8), CVE-2023-22894 in Strapi (7.2), CVE-2016-3081 in Apache Struts (8.1) and CVE-2015-5477 in ISC BIND (7.5). Four of the five date from 2015 to 2021, and patches have been available for years. ProFTPD's mod_copy flaw allows unauthenticated file read and write, ONLYOFFICE's path traversal can lead to remote code execution, Strapi's flaw exposes sensitive user data stored in cleartext, Struts allows command injection when Dynamic Method Invocation is enabled, and BIND can be crashed by a single unauthenticated TKEY query.
Seven nations, one campaign
Joint advisory AA26-281A, issued by the United States, United Kingdom, Australia, Canada, Japan, New Zealand and Spain, describes a China-linked operation scanning for old bugs, spraying passwords against Microsoft Exchange, hiding behind SoftEther VPN software and stealing email and credentials. The advisory links the activity to Integrity Technology Group, a China-based cybersecurity company, and to operations publicly associated with Flax Typhoon, Ethereal Panda and Red Juliett. The campaign targeted eight flaws in total: the five newly listed plus three already in the KEV catalog, namely GNU Bash, Ivanti Pulse Connect Secure and GitLab. CISA's unusually short three-day deadline reflects its judgement that confirmed exploitation of these older vulnerabilities poses an immediate risk, and that nation-state actors do not need zero-days when forgotten servers remain unpatched.
