Patch ISC BIND, Apache Struts, Strapi, ONLYOFFICE, and ProFTPD for CISA KEV additions
CISA added five exploited vulnerabilities to the Known Exploited Vulnerabilities catalog with a compliance deadline of October 11, 2026.
Key points
- CISA added five exploited vulnerabilities to the KEV catalog in the last seven days.
- The entries affect ISC BIND, Apache Struts, Strapi, ONLYOFFICE Docs, and ProFTPD.
- None of the five additions involve known ransomware use, according to our data desk analysis.
The Cybersecurity and Infrastructure Security Agency added five exploited vulnerabilities to its Known Exploited Vulnerabilities catalog this week. Our data desk analysis of public records confirms these additions were made within the last seven days. The new entries carry a due date of October 11, 2026. Organizations are expected to address these flaws by that date as listed in the public catalog.
Root cause
The catalog update includes CVE-2015-5477 affecting ISC BIND, a widely used Domain Name System software suite. It also lists CVE-2016-3081 in Apache Struts, a Java web application framework. The third entry is CVE-2023-22894, which impacts Strapi, a headless content management system. These flaws were added to the KEV catalog, indicating they are exploited.
Attack path
The remaining two entries are CVE-2021-3199 in ONLYOFFICE Docs and CVE-2015-3306 in ProFTPD. Our analysis notes zero with known ransomware use for these five specific vulnerabilities. This statistic suggests the exploits may not be directly linked to ransomware campaigns in the current data set.
Affected versions
The vulnerabilities span multiple vendors and software types. ISC BIND is affected by CVE-2015-5477. Apache Struts is impacted by CVE-2016-3081. Strapi users must address CVE-2023-22894. ONLYOFFICE Docs contains CVE-2021-3199. Finally, ProFTPD is vulnerable to CVE-2015-3306. All five entries share the same October 11, 2026, due date.
Mitigation
Organizations should verify their current software versions against the listed CVEs. Prioritize patching systems exposed to the internet or untrusted networks. Monitor logs for suspicious activity related to these specific vulnerability IDs. Ensure that configuration management tools enforce the latest secure versions where possible.
What to do and how to stay safe: CISA
- Inventory all servers running ISC BIND, Apache Struts, Strapi, ONLYOFFICE, or ProFTPD to identify exposure.
- Check vendor advisories for patches addressing CVE-2015-5477, CVE-2016-3081, CVE-2023-22894, CVE-2021-3199, and CVE-2015-3306.
- Apply available updates immediately or isolate affected systems if patches are not yet ready for production.
- Review firewall rules to restrict access to these services from untrusted networks until remediation is complete.
Step-by-step guide: Vulnerability Management Definition and Process
General security guidance from the DarkWeb Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific CVEs were added to the KEV catalog this week?
The additions are CVE-2015-5477, CVE-2016-3081, CVE-2023-22894, CVE-2021-3199, and CVE-2015-3306.
Is there a known ransomware link to these vulnerabilities?
No, the source material states there are zero with known ransomware use for these five entries.
When is the deadline to remediate these vulnerabilities?
The due date for all five entries is October 11, 2026.
