What happened
CISA, the US cybersecurity agency, added five old flaws, some more than a decade old, to its Known Exploited Vulnerabilities (KEV) catalog. The update coincides with a joint advisory from seven countries, including Japan (with Australia, Canada, New Zealand, Spain, the UK and the US), on operations attributed to actors linked to Integrity Technology Group, a China-based cybersecurity company, according to Security Affairs.
The five flaws
| CVE | Product | Type | CVSS |
|---|---|---|---|
| CVE-2015-3306 | ProFTPD | access control (SITE CPFR/CPTO commands) lets attackers read/modify files | 10.0 |
| CVE-2021-3199 | ONLYOFFICE Docs | path traversal with JWT enabled, possible code execution | 9.8 |
| CVE-2016-3081 | Apache Struts | command injection via method: with Dynamic Method Invocation | 8.1 |
| CVE-2015-5477 | ISC BIND | TKEY query triggers denial of service | 7.5 |
| CVE-2023-22894 | Strapi | sensitive data exposure via admin-panel query filters | 7.2 |
According to Security Affairs, the activity involved eight vulnerabilities in total, including these five, to gain initial access and steal information. Attackers also used scanning tools, XSS and password spraying against Microsoft Exchange servers, plus VPN software to keep access and scripts to extract emails and credentials.
Tools seized
The Justice Department and FBI seized two tools attributed to the company: Microscan, used to scan networks for vulnerable systems, and FishHub, which used spear-phishing to deliver malware, enable remote access and steal files. They were reportedly used against critical infrastructure and other organizations in several countries.
US federal agencies had until October 11, 2026 to fix the flaws.
Why 2015 flaws still matter
Because forgotten servers stay online: an old FTP box, an internal DNS server never updated, a legacy Struts app. Automated scanners like the one described find these systems at scale. Japan's participation in the advisory shows Japanese companies are in scope too.
SME checklist
- Inventory exposed assets: list everything reachable from the internet, including old "temporary" servers.
- Look for the five versions above and update or shut them down. 2015-era ProFTPD and BIND should not be in production.
- Exchange: enable MFA, block legacy authentication and watch for password spraying.
- Spear-phishing training.
- Track CISA's KEV catalog as a patch priority list, even outside the US.
Sources
- Security Affairs (Oct 11, 2026): https://securityaffairs.com/200734/security/u-s-cisa-adds-proftpd-onlyoffice-docs-strapi-apache-struts-and-isc-bind-flaws-to-its-known-exploited-vulnerabilities-catalog.html
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Want to map and shrink your company's attack surface? KGA IT offers a free consultation: kga-it.com.