CISA Adds ProFTPD, Strapi, Apache Struts Flaws to Known Exploited Vulnerabilities Catalog

The US Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. According to Security Affairs, these additions include flaws in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND software products.

CISA maintains the KEV catalog to identify vulnerabilities that are currently being exploited by threat actors. The agency added these five specific flaws to the broader list of known exploited issues. This action alerts organizations that these weaknesses are actively used in cyber attacks.

Context and Background

The KEV catalog serves as a critical resource for federal agencies and private sector defenders. By listing these vulnerabilities, CISA indicates that proof of exploitation exists. Security Affairs reported that these five vulnerabilities were added to the catalog recently. This inclusion requires federal agencies to prioritize remediation efforts for these specific software components.

The selection of these products highlights the diverse attack surface available to adversaries. The list covers file transfer protocols, document editing suites, headless content management systems, Java frameworks, and domain name system software. Each category represents a different layer of the typical enterprise infrastructure.

Who Is Affected

Organizations using ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, or ISC BIND are directly affected by this update. ProFTPD is a popular FTP server software used for file transfers. ONLYOFFICE Docs is a collaborative document editing suite. Strapi is a headless content management system. Apache Struts is a Java web application framework. ISC BIND is a widely used DNS software.

Administrators for these systems must verify their current versions against the KEV catalog. The presence of these items in the catalog means attackers are actively targeting them. Users of these platforms should assume their environments are at risk until they confirm the status of their software.

What should you do?

Administrators should immediately check their inventory for the affected software versions. They must cross-reference their installed versions with the CISA KEV catalog entries. Organizations should prioritize patching these systems according to vendor guidance. Monitoring logs for unusual activity related to these services is also recommended.

What to do and how to stay safe: CISA

• Audit your infrastructure to identify any instances of ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, or ISC BIND.
• Compare your current software versions against the CISA Known Exploited Vulnerabilities catalog to determine exposure.
• Apply security updates provided by the respective vendors as soon as they become available.
• Monitor network traffic and system logs for indicators of compromise related to these specific software flaws.

Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which software vendors are included in this CISA KEV update?

The update includes vulnerabilities from ProFTPD, ONLYOFFICE, Strapi, Apache, and ISC.

What is the CISA Known Exploited Vulnerabilities catalog?

It is a list of vulnerabilities that CISA has confirmed are being actively exploited in the wild.

Why did CISA add these specific flaws to the catalog?

CISA added them because there is evidence that threat actors are actively exploiting these vulnerabilities.