CISA adds five exploited vulnerabilities to KEV catalog with 2026-10-11 due date
The Cybersecurity and Infrastructure Security Agency added five new entries to its Known Exploited Vulnerabilities catalog, setting a remediation deadline of October 11, 2026.
Key points
- Five new vulnerabilities were added to the KEV catalog in the past seven days.
- No known ransomware use is associated with these five specific entries.
- Affected vendors include ISC, Apache, Strapi, ONLYOFFICE, and ProFTPD.
The Cybersecurity and Infrastructure Security Agency (CISA) added five new entries to its Known Exploited Vulnerabilities (KEV) catalog. Our data desk analysis confirms that these five additions occurred within a seven-day period, bringing the latest batch of exploited flaws to public attention.
At a glance
- Added (7 days)
- 5
- Vendors
- 5
All five new entries carry a due date of 2026-10-11, according to the public KEV catalog data. These vulnerabilities affect software from ISC, Apache, Strapi, ONLYOFFICE, and ProFTPD. The agency did not report any known ransomware use connected to these specific five additions during this reporting period.
Context and Background
The additions include CVE-2015-5477 in ISC BIND and CVE-2016-3081 in Apache Struts. Both are longstanding vulnerabilities that have been added to the KEV catalog with the same October 2026 due date. These entries join the list of flaws that CISA monitors for active exploitation in the wild.
The other three new entries are CVE-2023-22894 in Strapi, CVE-2021-3199 in ONLYOFFICE Docs, and CVE-2015-3306 in ProFTPD. Each of these was assigned the 2026-10-11 due date by CISA. The catalog serves as a critical resource for identifying which vulnerabilities require immediate attention due to active exploitation.
Who is Affected
Organizations using ISC BIND, Apache Struts, Strapi, ONLYOFFICE Docs, or ProFTPD are directly affected by this update. Administrators managing these services must review their current versions against the listed CVE IDs. The presence of these entries in the KEV catalog indicates that exploitation has been observed or is highly likely.
The inclusion of older CVEs like those from 2015 and 2016 suggests that legacy software remains a target. Even though these flaws are several years old, their addition to the KEV catalog signals continued relevance in active threat campaigns. Users of these specific products should prioritize checking their environments for these known issues.
What should you do?
Security teams should immediately verify if their infrastructure includes any of the five affected products. Cross-reference current software versions with the listed CVE IDs to determine exposure. If a system is running an affected version, plan for remediation based on the vendor's guidance.
What to do and how to stay safe: CVE-2015-5477
- Inventory all instances of ISC BIND, Apache Struts, Strapi, ONLYOFFICE Docs, and ProFTPD within your network.
- Check current software versions against the specific CVE IDs to identify if your systems are vulnerable.
- Monitor vendor announcements for patches or mitigation strategies for these exploited vulnerabilities.
- Review access logs for signs of exploitation attempts targeting these specific software components.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which vendors have products added to the KEV catalog this week?
The vendors are ISC, Apache, Strapi, ONLYOFFICE, and ProFTPD, according to the CISA KEV catalog data.
Are any of these vulnerabilities linked to ransomware groups?
No, the source material states that there were zero known ransomware uses associated with these five KEV additions.
What is the remediation deadline for these five new KEV entries?
The due date for all five entries is October 11, 2026, as listed in the CISA KEV catalog.
