CISA adds five exploited flaws to KEV catalog with 2026 compliance deadline

The Cybersecurity and Infrastructure Security Agency added five exploited vulnerabilities to its Known Exploited Vulnerabilities catalog this week, according to our data desk analysis of public CISA records. These additions cover a range of software products, including ISC BIND, Apache Struts, Strapi, ONLYOFFICE Docs, and ProFTPD. Each entry carries a due date of October 11, 2026, for remediation. Our analysis confirms there were five KEV additions in seven days. This count was derived from CISA's public KEV catalog. The data shows zero instances of known ransomware use associated with these specific vulnerabilities.

Root cause

The root causes for these five entries vary by product, as they originate from different vendors and codebases. ISC BIND, a widely used DNS software, contains CVE-2015-5477, which was added to the catalog. Apache Struts, a Java web application framework, has CVE-2016-3081 listed as exploited. Strapi, a headless CMS, is affected by CVE-2023-22894. ONLYOFFICE Docs, a document editing suite, has CVE-2021-3199 included in the KEV. ProFTPD, an FTP server, is represented by CVE-2015-3306. Each flaw represents a distinct security failure within its respective application.

Attack path

The KEV catalog tracks vulnerabilities that are actively being exploited in the wild. The source material does not specify the exact attack paths or motives for these five entries. It only confirms that they are exploited. The absence of known ransomware use is noted in the data. No further details on how attackers leverage these flaws are provided in the source material. Organizations should treat these as active threats based on their KEV status.

Affected versions

All five products have specific versions affected by the listed CVEs, though the source material does not detail the exact version ranges. Organizations using ISC BIND, Apache Struts, Strapi, ONLYOFFICE Docs, or ProFTPD should verify their current versions against the respective vendor advisories. The KEV catalog entry for each CVE serves as a definitive list of what is considered exploited. Users of these products must assume their instances are at risk if they have not already applied patches or mitigations for these specific CVEs.

Mitigation

• Identify all instances of ISC BIND, Apache Struts, Strapi, ONLYOFFICE Docs, and ProFTPD within your environment.
• Cross-reference current software versions with the specific CVEs listed in the CISA KEV catalog.
• Apply vendor-provided patches or updates to address CVE-2015-5477, CVE-2016-3081, CVE-2023-22894, CVE-2021-3199, and CVE-2015-3306.
• Monitor security advisories from these vendors for additional guidance on temporary mitigations if patches are not immediately available.

Background: Apache Struts vulnerabilities

You likely expose your application to remote code execution by running outdated Struts versions, ignoring XML parser settings, or failing to validate file uploads. Fix these 6 common mistakes immediately by updating dependencies, disabling unsafe parsers, and enforcing strict input validation.

Read the full guide: 7 Apache Struts Mistakes That Leave Your Server Open to Attack

What to do and how to stay safe: CISA

• Audit your network for any servers or applications running ISC BIND, Apache Struts, Strapi, ONLYOFFICE Docs, or ProFTPD to determine exposure.
• Check your patch management logs to confirm that systems have been updated to versions that address the specific CVEs listed in the KEV.
• Review firewall rules and access controls to limit exposure of these services to untrusted networks until patches are verified.
• Subscribe to security advisories from these vendors to receive timely notifications about future vulnerabilities or updates.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which CVEs were added to the KEV catalog this week?

CVE-2015-5477, CVE-2016-3081, CVE-2023-22894, CVE-2021-3199, and CVE-2015-3306 were added to the catalog.

What is the compliance deadline for these KEV entries?

The deadline for remediation for all five entries is October 11, 2026.

Are any of these vulnerabilities linked to ransomware attacks?

No, our analysis found zero instances of known ransomware use associated with these five vulnerabilities.