U.S. CISA adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND flaws to its Known Exploited Vulnerabilities catalog
CISA added five exploited ProFTPD, ONLYOFFICE, Strapi, Struts, and BIND flaws to the KEV catalog.
CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2015-3306 in ProFTPD (CVSS 10.0), CVE-2021-3199 in ONLYOFFICE Docs (9.8), CVE-2023-22894 in Strapi (7.2), CVE-2016-3081 in Apache Struts (8.1), and CVE-2015-5477 in ISC BIND (7.5). The flaws are tied to operations attributed to China-linked actors associated with Integrity Technology Group, alongside a joint advisory from Australia, Canada, Japan, New Zealand, Spain, the UK, and the US. Operators reportedly exploited eight vulnerabilities for initial access, used scanning, XSS, and password spraying against Microsoft Exchange, and maintained access with VPN software while extracting email and credentials. The DOJ and FBI seized Microscan and FishHub, and federal agencies must remediate by October 11, 2026.
- Five older flaws in ProFTPD, ONLYOFFICE Docs, Strapi, Struts, and BIND entered CISA KEV.
- Activity is linked to Integrity Technology Group and a seven-country joint advisory.
- Attackers scanned, sprayed Exchange passwords, phished, and stole email and credentials.
- DOJ and FBI seized Microscan and FishHub scanning and phishing tools.
- FCEB agencies must patch by October 11, 2026 under BOD 22-01.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1110.003 Password SprayingT1566 PhishingT1595.002 Vulnerability ScanningT1133 External Remote Services
- Threat actors
- Integrity Technology Group
- Organizations
- CISAFBIU.S. Department of Justice
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-3306 | Arbitrary file read/write via ProFTPD 1.3.5 mod_copy | 10.0 | 99% | KEVPoC ×5 | KEV |
| CVE-2015-5477 | Remote denial of service in ISC BIND via TKEY queries | 7.5 | 100% | KEV | KEV |
| CVE-2016-3081 | Command injection RCE in Apache Struts Dynamic Method Invocation | 8.1 | 97% | KEVPoC ×2 | KEV |
| CVE-2021-3199 | Path Traversal RCE in ONLYOFFICE Document Server | 9.8 | 30% | KEVPoC ×2 | KEV |
| CVE-2023-22894 | Sensitive-data leak in Strapi admin query filters (through 4.5.5) | 4.9 | 4% | KEVPoC ×2 | KEV |
From the original article
2 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND to its Known Exploited Vulnerabilities catalog.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.