Three of the five bugs that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) just added to its list of actively exploited vulnerabilities were disclosed in 2015 and 2016. On October 8, 2026, CISA added flaws in ProFTPD, ISC BIND and Apache Struts to its Known Exploited Vulnerabilities (KEV) catalog, alongside a 2021 bug in ONLYOFFICE Docs and a 2023 bug in the Strapi content management system.
A KEV entry means CISA has evidence that a flaw is being exploited in the wild. It does not say by whom or against which targets, and CISA published neither. For all five entries the catalog lists known ransomware campaign use as "Unknown". CISA set a remediation due date of October 11, three days after listing, under its Binding Operational Directive 26-04, and marked four of the five (every entry except BIND) for the forensic triage requirements in that directive's guidance.
Five old bugs, ranked by severity
The descriptions below are CISA's own catalog wording. Scores are the published NVD CVSS ratings.
- CVE-2015-3306, ProFTPD (CVSS 10.0): an improper access control flaw that could allow remote attackers to read and write arbitrary files via the site cpfr and site cpto commands.
- CVE-2021-3199, ONLYOFFICE Docs (CVSS 9.8): a path traversal flaw that can occur when JWT is used, through a crafted image upload parameter, and could allow remote code execution.
- CVE-2016-3081, Apache Struts (CVSS 8.1): a command injection flaw that could allow remote attackers to execute arbitrary code via the method: prefix when Dynamic Method Invocation is enabled.
- CVE-2015-5477, ISC BIND (CVSS 7.5): a data processing error that could allow remote attackers to cause a denial of service via TKEY queries.
- CVE-2023-22894, Strapi (CVSS 4.9): cleartext storage of sensitive information that could let attackers with admin panel access discover sensitive user details via the query filter. CISA notes it can be chained with CVE-2023-22621 to achieve remote code execution, and that affected products may be end of life.
The catalog says exploited, not how
CISA did not explain why these entries were added now, and the listing carries no exploitation detail beyond the fact of it. The vendor advisories cited in each entry hold the fix information. What the data does show is that these are not obscure bugs: the three oldest carry EPSS exploitation probability scores above 0.96, among the highest any CVE receives.
Struts is a Java web framework, ProFTPD an FTP server and BIND one of the most widely deployed DNS servers, so all three can end up embedded in long-lived infrastructure that outlasts the attention of whoever installed it.
Patch, or retire what cannot be patched
CISA's required action is to apply mitigations according to vendor instructions, or to discontinue use of the product if no mitigation is available. The catalog points to Apache's S2-032 bulletin for Struts, Strapi's security disclosure, ONLYOFFICE's DocumentServer changelog, and the Debian security announcement for ProFTPD. Organizations that cannot find a supported fix for an exposed instance should take it offline.
CISA's deadline has already passed, and it was set three days out. Earlier this month an exploited NetScaler bug showed how much a KEV entry can hinge on the exact build installed; this batch makes the opposite point. A vulnerability does not expire when its vendor ships a fix. It stays live for as long as one forgotten copy remains reachable, and CISA's listing says some of these still are.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.