Five old CVEs in CISA KEV: BIND, Struts, ProFTPD, ONLYOFFICE, Strapi

On 8 October 2026 CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog that most teams patched, or meant to, years ago: a BIND crash from 2015, an Apache Struts code-execution bug from 2016, the ProFTPD mod_copy flaw from 2015, an ONLYOFFICE Docs path traversal fixed in 2020 and a Strapi data leak from 2023. Every one has had a vendor fix for more than three and a half years.

They did not arrive with the usual "CISA Adds Known Exploited Vulnerabilities" alert. They arrived inside joint advisory AA26-281A, published the same day by the FBI, CISA, NSA and agencies from the UK, Australia, Canada, Japan, New Zealand and Spain, about Chinese government-linked actors "enabled by the Integrity Technology Group". Its appendix lists eight CVEs the actors "successfully exploited" and marks these five as newly added to KEV. The federal deadline was three days later, Sunday 11 October.

This briefing covers why old bugs land in KEV, what each of the five is, who is likely still running affected versions, and how to check and fix each one.

Why 2015 bugs land in KEV in 2026

KEV lists vulnerabilities with evidence of exploitation, not new ones. CISA's conditions are a CVE ID, "reliable evidence of active exploitation in the wild", a clear remediation and significant risk to federal systems. Age is not among them. CISA's BOD 26-04 guidance says a vulnerability "may qualify for inclusion in the KEV Catalog at any time, regardless of its age", and that CISA "does not assume that all running legacy products are fully patched".

Here the evidence came from FBI investigations. AA26-281A says its information "originates from technical evidence recovered from, and observed during, multiple Federal Bureau of Investigation (FBI) investigations related to Integrity Technology Group". It describes MicroScan, a web application with more than 1,300 penetration-testing scripts that the actors used "as early as 2017", and says its CVE table was "recovered from penetration testing scripts". It does not say when each CVE was used, against whom, or whether any is still in use.

That gap matters. CISA's FAQ says the addition of an older CVE "does not necessarily indicate that CISA is currently observing active exploitation." What the listing does establish is that a capable actor kept working exploits for these bugs, and that anything still running them is exposed to the same automated scanning.

The three-day deadline comes from BOD 26-04, which replaced BOD 22-01 in June 2026. CISA now derives each KEV due date from asset exposure, automation and technical impact: on a publicly exposed asset, a KEV vulnerability with total technical impact gets three days plus a "forensic triage" to check whether the asset is already compromised. All five carry the 11 October date, and CISA's records rate all five as total technical impact:

BIND stands out: ISC describes a crash, CISA's record still rates its impact as total, and the KEV entry asks for no forensic triage. CISA has not published its reasoning.

ISC BIND: CVE-2015-5477

What it is. A crafted query for a TKEY record makes named fail a REQUIRE assertion and exit. ISC rated it critical, said "both recursive and authoritative servers are vulnerable", and warned that ACLs and configuration limits do not help, because the faulty code runs "early in the packet handling, before checks enforcing those boundaries". There was no workaround. The result is denial of service: the DNS server stops. ISC credits Jonathan Foote, published on 28 July 2015, and noted on 1 August that proof-of-concept code was public.

Who still runs it. Old Linux images and appliances. NVD's affected configurations go well beyond ISC's builds: Red Hat Enterprise Linux 5 to 7, Debian 7 and 8, Ubuntu 12.04, Solaris, HP-UX, Juniper Junos and NetApp clustered Data ONTAP.

How to check. Ask the package manager, not the version string, because distributions backported the fix. Red Hat fixed RHEL 7 in bind-9.9.4-18.el7_1.3 and RHEL 6 in bind-9.8.2-0.37.rc1.el6_7.2, both of which show an upstream version inside ISC's affected range. For appliances, go by the vendor's advisory; the KEV entry links Juniper's.

named -v                                   # upstream version of the local binary
rpm -q bind || dpkg -l 'bind9*'            # distribution package and its patch level
dig @ns1.example.com version.bind chaos txt +short   # what your server reports, if not hidden

How to fix. Upgrade to a supported BIND from ISC or your distribution, or to the appliance vendor's fixed firmware. Since ACLs do not protect against this bug, restricting who can query is no substitute.

Apache Struts: CVE-2016-3081 (S2-032)

What it is. When Dynamic Method Invocation (DMI) is enabled, a request can pass an expression through the method: prefix that runs code on the server. Apache's bulletin S2-032 rates it Important, with "Possible Remote Code Execution"; NVD scores it 8.1. Apache credits Nike Zheng and released the fixes on 19 April 2016.

Who still runs it. Java web applications that never left Struts 2.3, and products that bundle it: NVD lists Huawei OceanStor storage firmware and Oracle applications including FLEXCUBE Private Banking and Siebel e-Billing. Configuration decides exposure. Struts's own default.properties has shipped with DMI off since 2.3.15.2, so an application is vulnerable only if its configuration switches DMI on.

How to check. Find every struts2-core jar, including those packed inside WAR and EAR files, then look for the DMI setting in the deployed configuration.

# Struts jars on disk, including unpacked web apps
find / -xdev -name 'struts2-core-*.jar' 2>/dev/null
# Struts packed inside WAR and EAR files
find / -xdev \( -name '*.war' -o -name '*.ear' \) 2>/dev/null | while read -r f; do
  unzip -l "$f" 2>/dev/null | grep -q 'struts2-core' && echo "$f"
done
# Applications that switch Dynamic Method Invocation on
grep -rn 'struts.enable.DynamicMethodInvocation' /path/to/webapps 2>/dev/null
unzip -p app.war WEB-INF/classes/struts.xml | grep -n 'DynamicMethodInvocation'

Jars nested inside other jars escape a simple search; software composition analysis finds those.

How to fix. For the vulnerable branch, Apache's options were to disable DMI or upgrade to 2.3.20.3, 2.3.24.3 or 2.3.28.1. With 2.3.x out of support for seven years, the lasting fix is a migration to a supported Struts release; the project lists 7.4.0 as its best available. Until then, set DMI to false and confirm it in the deployed artifact, not the source tree. For a vendor product, the fix has to come from the vendor.

ProFTPD: CVE-2015-3306 (mod_copy)

What it is. ProFTPD's mod_copy module adds the SITE CPFR and SITE CPTO commands for copying files on the server. In 1.3.5 it accepted them from clients that had not logged in, so anyone who could reach the FTP port could copy any file the server could read to anywhere it could write. The original report, from Vadim Melihow, showed a copy of /etc/passwd and a PHP file written where a web server would run it, which is how a file copy becomes code execution. Debian's advisory says the flaw could "possibly" allow arbitrary code execution; CISA's record scores it 10.0 in CVSS 3.1.

Who still runs it. Long-lived Linux hosts and devices with FTP switched on. ProFTPD's documentation says mod_copy "is not compiled by default", but Debian's package included it, and Debian's fix for jessie, 1.3.5-1.1+deb8u1, still reports version 1.3.5. AA26-281A says the actors concentrate their scans on a handful of ports, and port 21 is one of them.

How to check.

proftpd -v                          # version
proftpd -l | grep -i mod_copy       # mod_copy compiled in statically
grep -rn 'mod_copy' /etc/proftpd* /usr/local/etc/proftpd* 2>/dev/null   # loaded as a shared module
dpkg -l 'proftpd*' || rpm -q proftpd   # distribution patch level
nmap -sV -p 21 192.0.2.0/24         # banners on ranges you own and may scan

How to fix. Upgrade to a current ProFTPD or your distribution's patched package. If you do not use mod_copy, do not load it; from 1.3.6rc1, CopyEngine off disables it without a rebuild. The ProFTPD maintainer added that directive with the fix so that future mod_copy problems could be switched off at runtime. Then ask whether the FTP service needs to face the internet at all.

ONLYOFFICE Docs: CVE-2021-3199

What it is. A path traversal in Document Server's /upload handler: when JWT is in use, a /.. sequence in an image upload parameter writes outside the intended folder, which the CVE record says can lead to remote code execution. NVD scores it 9.8. ONLYOFFICE's changelog for 5.6.3 lists a single back-end fix: "Fix Path Traversal vulnerability via image upload params (Bug #46113)". The CVE ID dates from January 2021, but the fix shipped in August 2020.

Who still runs it. Self-hosted Document Server instances, from Docker images or packages, that have not been updated since 2020. The KEV entry notes that the flaw could affect a component used by other products, so check anything that bundles Document Server too.

How to check.

docker ps --format '{{.Image}}  {{.Names}}' | grep -i 'onlyoffice/documentserver'
dpkg -s onlyoffice-documentserver 2>/dev/null | grep '^Version'
rpm -q onlyoffice-documentserver

An image tagged latest tells you nothing until you know when it was last pulled.

How to fix. Upgrade to a current release. CISA asks for forensic triage on this one, so an instance that faced the internet on 5.6.2 or earlier needs a look for files written where they should not be, not only an upgrade.

Strapi: CVE-2023-22894

What it is. Strapi's query filters let a user filter records on fields that should stay private, such as password hashes and reset tokens, and infer their values from the responses. The CVE record describes an attacker with admin panel access; with super admin access, that means the password hash and reset token of every user. Strapi's own disclosure goes further. The researcher, GhostCcamm, later found a way to exploit it without logging in, and chained it with CVE-2023-22621, a template injection in the users-permissions email templates, to run code on Strapi 4.5.5 and earlier. CISA's entry mentions the chain; CVE-2023-22621 itself is not in KEV.

The scores reflect that disagreement: NVD gives 4.9 on the assumption that admin access is needed, CISA's record 7.2, and Strapi's own vector assumes no privileges at all.

Who still runs it. Headless CMS back ends started on Strapi 3 or early 4 and never upgraded. Strapi's security policy marks 3.x end of life since 2022 and 4.x since April 2026, when its security fixes stopped. Every affected version is now also unsupported.

How to check. Read the installed version in each project, then run the log search Strapi published.

# Strapi 4 is the @strapi/strapi package; Strapi 3 is the unscoped strapi package
npm ls @strapi/strapi strapi
# Strapi's published pattern for requests that filter on private fields
grep -iE '(\[|%5B)\s*(email|password|reset_password_token|resetPasswordToken)\s*(\]|%5D)' /path/to/access.log

Strapi says repeated matches on the password or reset-token fields mean "you need to immediately start an incident response".

How to fix. Move to Strapi 5. Version 4.8.0 closed this bug, but 4.x no longer gets security fixes, and Strapi says 3.x never received a patch for it. If the log search matches, start incident response before or alongside the upgrade, as Strapi advises.

Is it being exploited?

What the listing establishes. CISA adds a CVE only with "reliable evidence of active exploitation in the wild". AA26-281A lists all five among the CVEs that actors enabled by Integrity Technology Group "successfully exploited", in tooling the FBI recovered. The advisory says these actors use techniques consistent with the activity industry calls Flax Typhoon, Ethereal Panda and Red Juliett, and cautions that vendor names may not map one to one to the US government's view. KEV lists ransomware use as unknown for all five.

What it does not establish. When each CVE was exploited, which victims were reached through which bug, or whether any of the five is being exploited today. The advisory gives no dates per CVE, and CISA's FAQ says an old CVE's addition "does not necessarily indicate" current exploitation.

What else is public. We found no vendor statement, honeypot data or incident report since 8 October showing new exploitation of these five; coverage so far repeats the advisory. Exploitation has been cheap for years, though. ISC noted public proof-of-concept code four days after disclosure, the CVE records for the Struts and ProFTPD bugs link Metasploit modules, the ONLYOFFICE record links proof-of-concept code, and Strapi describes the researcher's working chain.

The advisory's table also names three CVEs that were already in KEV: CVE-2014-6278 in GNU Bash, CVE-2019-11510 in Pulse Connect Secure and CVE-2021-22205 in GitLab. If this actor is in your threat model, check those as well.

Find them on your network

Everything here is read-only. Scan only systems you own or have written permission to test.

1. Start from exposure. AA26-281A says the actors focus on ports 21 (FTP), 22 (SSH), 53 (DNS), 80 and 443 (HTTP and HTTPS) and 1080 (SOCKS). List what you expose on those ports first; an internet-facing FTP or DNS server is the obvious place to begin.
2. Fingerprint, then confirm. Banners from nmap -sV are a first pass for FTP and DNS, but backported packages and hidden banners make them wrong in both directions. Confirm on the host with the package manager.
3. Search inside software. Struts and Strapi arrive as dependencies. A software bill of materials or composition analysis finds struts2-core inside WAR files and @strapi/strapi in lockfiles that an installed-software list never shows.
4. Use vendor advisories for appliances. For devices with embedded BIND or Struts, NVD's configuration lists and the vendor's own bulletin are the reference, not the upstream version.
5. Look for the actor, not only the bug. If a vulnerable instance was exposed, the advisory's indicators apply: SoftEther VPN clients installed for persistence, often renamed conhost.exe or dllhost.exe, plus the domains and file names in its appendix, which CISA publishes as STIX files.

Old bugs are the cheap ones

These five share a pattern: an exposed service nobody upgraded, a bug fixed years ago with public exploit code, and an actor whose scanner already knows it. The response is unglamorous: upgrade, retire what is out of support, and stop exposing services that have no reason to be public. Confirm the result with evidence, not a version string; how a retest verifies a fix explains Rokkhe's approach for findings it has reproduced. For the rest of October's additions, see the October KEV roundup.