CISA Adds Five Bugs, Up to 11 Years Old, to Its Exploited List

CISA added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue on Oct. 8, the oldest published 11 years ago: ISC BIND CVE-2015-5477, ProFTPD CVE-2015-3306, Apache Struts CVE-2016-3081, ONLYOFFICE Docs CVE-2021-3199 and Strapi CVE-2023-22894. Federal agencies have until Oct. 11, three days, to mitigate.

The catalogue entries do not say who is exploiting the flaws, against whom, or how often. A listing means CISA has evidence of exploitation; each bug still has preconditions that decide whether a given server is exposed.

What each bug needs

1. ProFTPD CVE-2015-330611.4 years
2. ISC BIND CVE-2015-547711.2 years
3. Apache Struts CVE-2016-308110.5 years
4. ONLYOFFICE Docs CVE-2021-31995.7 years
5. Strapi CVE-2023-228943.5 years

Source: NVD CVE records (published dates) and CISA KEV catalogue, accessed 2026-10-11; ages computed to one decimal

Product and CVE	NVD published	Effect, per CISA	Triage flag
ProFTPD CVE-2015-3306	May 18, 2015	Read and write arbitrary files via site cpfr and site cpto	Yes
ISC BIND CVE-2015-5477	July 29, 2015	Denial of service via TKEY queries	No
Apache Struts CVE-2016-3081	April 26, 2016	Code execution via method: prefix	Yes
ONLYOFFICE Docs CVE-2021-3199	Jan. 26, 2021	Path traversal, possible code execution	Yes
Strapi CVE-2023-22894	April 19, 2023	Cleartext user details via query filter	Yes

The Struts bug needs Dynamic Method Invocation enabled. Apache's bulletin S2-032 rates it Important, lists 2.3.20 through 2.3.28 (except 2.3.20.3 and 2.3.24.3) as affected and gives 2.3.20.3, 2.3.24.3 and 2.3.28.1 as fixes, crediting Nike Zheng. Disabling the feature is the workaround. The ProFTPD bug is reachable through the site cpfr and site cpto commands, which CISA ties to read and write access on arbitrary files. BIND is the one entry without the forensic-triage flag, and CISA describes its flaw as a denial of service only.

ONLYOFFICE's path traversal applies when JWT is used, through a /.. sequence in an image upload parameter, and the catalogue entry points to the 5.6.3 changelog entry. Strapi is the one with a vendor timeline: Strapi's disclosure says CVE-2023-22894 affects 3.2.1 up to but not including v4.8.0, fixed March 15, 2023 and disclosed April 17, 2023. Chained with CVE-2023-22621 it gave unauthenticated code execution on Strapi v4.5.5 and earlier. CISA's text says attackers need admin panel access, while Strapi says researchers later found unauthenticated users could exploit it, and CISA flags the product as possibly end of life.

The three-day clock

Under Binding Operational Directive 26-04, issued June 10, an entry marked for forensic triage must be remediated or mitigated within three days, and the agency must check the asset for compromise. The directive replaced the earlier KEV directive BOD 22-01.

The catalogue's JSON lists 122 additions from June 11 through Oct. 8. Ninety-nine carried a three-day deadline and 23 carried 14 days. All 78 triage-flagged entries had the short deadline, and so did 21 of the 44 unflagged ones. Fourteen of the 122 had CVE IDs from 2023 or earlier, and an Aug. 26 batch of six included three flaws from 2015 and 2021 on a 14-day clock.

Seven entries on Sept. 2 and six on Aug. 26 were larger single-day additions than this one. The Flax Typhoon advisory also leaned on old CVEs, eight of them. A vendor fix that ships quietly, as with AnyDesk's no-CVE patch, leaves defenders who track only advisories with the same gap.

If these products run on an internet-facing host, check Struts for Dynamic Method Invocation, ProFTPD for the site cpfr and site cpto commands, and Strapi for a version below 4.8.0. BOD 26-04 counts calendar days, so the Oct. 11 deadline falls on a Sunday.