CISA added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on 2026-10-08, with a federal remediation deadline of 2026-10-11, which is today. That deadline binds US Federal Civilian Executive Branch agencies. Everyone else can treat it as a prioritization signal, not an obligation.
SecurityAffairs reports that the update coincides with a joint advisory from Australia, Canada, Japan, New Zealand, Spain, the United Kingdom and the United States. The article ties the listings to a China-linked campaign attributed to actors associated with Integrity Technology Group, a Chinese cybersecurity company. Related coverage of the KEV addition is also available.
The five entries and their affected versions
The version details below come from NVD records.
| CVE | Product and scope | CVSS v3 (NVD) | Weakness |
|---|---|---|---|
| CVE-2015-3306 | ProFTPD 1.3.5, mod_copy module |
10.0 | CWE-284 |
| CVE-2021-3199 | ONLYOFFICE Document Server before 5.6.3, when JWT is used | 9.8 | CWE-22 |
| CVE-2016-3081 | Apache Struts, with Dynamic Method Invocation enabled | 8.1 | CWE-77 |
| CVE-2015-5477 | ISC BIND | 7.5 | CWE-19, CWE-617 |
| CVE-2023-22894 | Strapi | 4.9 | CWE-312 |
ProFTPD. Remote attackers can read and write arbitrary files through the site cpfr and site cpto commands. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, so no authentication or user interaction is needed.
ONLYOFFICE Document Server. A /.. sequence in an image-upload parameter of the /upload endpoint allows directory traversal and remote code execution when JWT is in use. The CVE record's only vendor-side reference is an ONLYOFFICE changelog entry. It also lists two third-party repositories hosting proof-of-concept scripts.
Apache Struts. The NVD description names three ranges: 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28. All require Dynamic Method Invocation to be enabled. Exploitation uses the method: prefix with chained expressions to reach code execution. The attack complexity is rated high (AC:H).
ISC BIND. A crafted TKEY query triggers a REQUIRE assertion failure and the daemon exits, a denial of service. The NVD description covers 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3. The NVD configuration data instead lists versions up to and including 9.9.7, and the two scopes are not identical.
Strapi. An authenticated admin-panel user can filter users by sensitive columns and infer values from API responses. With super admin access, NVD says password hashes and reset tokens of all users can be discovered. The description says "through 4.5.5", while the CPE data uses < 4.8.0. SecurityAffairs gives a CVSS score of 7.2, but the NVD record says 4.9 and requires high privileges (PR:H).
The ranges above are affected ranges, not fix releases. Check each vendor's own advisory for the corrected build.
Severity is not the same as exploitation
The Strapi entry shows why. Its NVD score is the lowest of the five, yet it sits in KEV beside a 10.0. KEV inclusion reflects evidence of exploitation, and CVSS reflects only technical severity. Most of these flaws are also several years old.
What the article says about the campaign
According to SecurityAffairs, the campaign exploited eight vulnerabilities, including these five, to gain initial access and steal sensitive information. The article does not name the other three.
The US Department of Justice and the FBI reportedly seized two tools that the article says were allegedly operated by the Chinese company:
- Microscan, reportedly used to scan networks for vulnerable systems.
- FishHub, reportedly used to send spear-phishing emails that deliver malware, give remote access and steal files.
The same report says the operators used scanning tools, cross-site scripting and password spraying against Microsoft Exchange servers. They reportedly relied on VPN software to keep access and used scripts to pull emails and credentials. The joint advisory, according to the article, warns about tooling that pairs large-scale scanning with hands-on exploitation.
What defenders should do
CISA's action text in the NVD records tells operators to apply mitigations per vendor instructions. It also points to BOD 26-04 and to its "Forensics Triage Requirements". For cloud services, it says to follow the applicable BOD 26-04 guidance or discontinue use of the product if mitigations are unavailable. SecurityAffairs cites BOD 22-01 for the federal deadline instead.
Practical first steps:
- Inventory exposed ProFTPD 1.3.5, ONLYOFFICE Document Server, Struts, BIND and Strapi instances.
- On Struts, check whether Dynamic Method Invocation is enabled.
- On ONLYOFFICE, check whether JWT is in use.
- Review logs for the kinds of activity described above.
SecurityAffairs also advises private organizations to review the catalog and fix the listed flaws in their own infrastructure.
A series, not a single event
KEV has taken in other entries for overlapping vendors over the past 90 days. They are CVE-2015-5287 (2026-08-26), CVE-2026-21962 (2026-08-24), CVE-2026-34486 (2026-08-04) and CVE-2026-46817 (2026-07-15), tied to Oracle, Apache and Huawei.
