Exploited CVEs Last Week: Oct 5-11, 2026

CISA added five CVEs to its Known Exploited Vulnerabilities (KEV) catalog on Thursday, October 8, 2026, and the newest of them was published in 2023. The oldest, a ProFTPD flaw, dates to 2015. All five cover products that most teams assume were patched years ago: ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND.

The trigger was a joint advisory from the US, UK, Canada, Australia, New Zealand, Japan, and Spain on activity linked to China-based Integrity Technology Group, tracked by the private sector as Flax Typhoon. The FBI seized seven domains tied to the group's tools on the same day. Federal agencies had until October 11 to patch or stop using the affected software.

Nothing in this batch is a new bug. It is a reminder of how long an old, patched flaw stays useful to an operator who scans at scale.

Thursday, October 8: Five Old Flaws, One Campaign

All five entries share one KEV date and one due date, so the week reads as a single wave. Scores below come from the sources named in each item, and they differ by scoring version.

ProFTPD mod_copy (CVE-2015-3306)

The mod_copy module in ProFTPD 1.3.5 lets a remote, unauthenticated attacker read and write arbitrary files on the server through the SITE CPFR and SITE CPTO commands. NVD carries a CVSS v2 score of 10.0 and no v3 score. The fix shipped in ProFTPD 1.3.5a.

ONLYOFFICE Docs (CVE-2021-3199)

ONLYOFFICE Document Server before 5.6.3 has a path traversal flaw when JSON Web Tokens are in use. A "/.." sequence in an image upload parameter can lead to remote code execution. Reported severity is 9.8, and the fixed release is 5.6.3.

Strapi (CVE-2023-22894)

A user with access to the Strapi admin panel can filter on private fields and read back sensitive user data. Per NVD, a super admin can pull every user's password hash and password reset token. Strapi lists v3.2.1 up to but not including v4.8.0 as affected and shipped the fix in 4.8.0 on March 15, 2023. Scores range from 4.9 (NIST) to 9.8 (CISA-ADP) on the NVD page, because the two scorers disagree on whether any privilege is needed.

Apache Struts, S2-032 (CVE-2016-3081)

When Dynamic Method Invocation is enabled, the "method:" prefix lets an attacker pass an expression that runs code on the server. Struts 2.3.20 through 2.3.28 are affected, except 2.3.20.3 and 2.3.24.3. The fixed releases are 2.3.20.3, 2.3.24.3, and 2.3.28.1, and Apache's workaround is to turn Dynamic Method Invocation off. Reported severity is 8.1.

ISC BIND (CVE-2015-5477)

A crafted TKEY query triggers a REQUIRE assertion failure that crashes the named daemon in BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3. The impact is denial of service only. NVD lists a CVSS v2 score of 7.8, and other trackers show a v3 score of 7.5.

What the advisory says, and what it leaves out

Per the reporting on advisory AA26-281A, these five sit on a list of eight vulnerabilities the actors commonly target. The other three were already in KEV: Shellshock (CVE-2014-6278), Pulse Connect Secure (CVE-2019-11510), and GitLab (CVE-2021-22205). The advisory describes a Python scanner called MicroScan with more than 1,300 scripts, including ones for Struts, run partly through a botnet of Mirai-infected devices. It also names a spear-phishing tool called FishHub, EBurst password spraying against Exchange, and SoftEther VPN clients used for persistence.

The reporting does not tie any single CVE to a specific breach. The advisory also says not every incident in this cluster necessarily traces back to Integrity Tech. KEV status here means exploitation is confirmed for the campaign, and the public detail stops there.

Old Bugs, and an EPSS Score That Lags the Evidence

On October 11, the FIRST EPSS feed put ProFTPD at 99.5 percent, BIND at 99.4 percent, and Struts at 96.1 percent. ONLYOFFICE sat at 19.4 percent and Strapi at 3.6 percent. All five went into KEV on the same day with the same three-day deadline.

That is the reverse of what this series saw in earlier weeks, when brand-new CVEs with confirmed exploitation often showed EPSS at or below 2 percent. Fresh bugs lack the scan history that feeds the model. Old bugs that have been probed for years carry plenty of it, and the three oldest here score accordingly. Strapi is the clearest gap: a 3.6 percent score on a flaw that, per the advisory, belongs to a state-linked campaign. The bug needs an admin session, which may be why broad internet telemetry rarely sees it.

The practical reading is that KEV should trigger action and EPSS should rank what remains. A low EPSS on a KEV entry says the model has not caught up with the evidence, and it does not lower the urgency.

The patch age adds a second point. The ProFTPD and BIND fixes date to 2015, the Struts fixes to 2016, and the Strapi fix to March 2023. The exposure lives in servers nobody updated and nobody inventoried.

Reading the Week on VulnTracker

Filter the CVE table by KEV date and all five rows share one value, 10/08/2026, with a due date of 10/11/2026. That three-day window is the signal to act on first.

The Affected column shows N/A for these five at the time of writing, so take vendor and product from the sections above. The EPSS column carries the spread described earlier, from the 99 percent range down to single digits, and it moves daily. Sort by KEV date to keep the five together, then use EPSS and the SSVC columns to decide order inside the group.

What to Do This Week

The federal deadline has passed, so treat any match in your own estate as overdue.

Find the software first. Search for ProFTPD, ONLYOFFICE Document Server, Strapi, Struts-based applications, and BIND, including copies inside appliances, containers, and abandoned test servers.
Move to the fixed releases: ProFTPD 1.3.5a or later, ONLYOFFICE Document Server 5.6.3 or later, Strapi 4.8.0 or later, Struts 2.3.20.3, 2.3.24.3, or 2.3.28.1 at minimum (the 2.3 line is long out of support, so plan the move to a maintained release), and BIND 9.9.7-P2 or 9.10.2-P3 or later. If Struts cannot be updated today, turn Dynamic Method Invocation off.
On Strapi, search logs for admin requests that filter on email, password, or resetPasswordToken fields. Strapi's disclosure describes the pattern, and a match means treating the leaked hashes and reset tokens as compromised.
Check what else the advisory describes: SoftEther VPN clients named conhost.exe or dllhost.exe, password spraying against Exchange and Microsoft 365 accounts, and the indicators published in AA26-281A.
Close what does not need to be open. Ports 21 and 53 on the internet-facing side deserve a second look, and MFA belongs on every account that can reach mail.

A KEV entry tells you a bug is in use, whatever its age. Five patched flaws from 2015 to 2023 earned a three-day federal deadline this week because a state-linked operation was still finding them on real networks. Track the vendors you run on VulnTracker, and the next time an old CVE for one of them lands in KEV you will see the due date the day CISA sets it.