What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Five vulnerabilities across five products were reportedly added to CISA’s Known Exploited Vulnerabilities (KEV) catalog after exploitation attributed to Flax Typhoon. Contemporaneous reporting says Federal Civilian Executive Branch (FCEB) agencies had to patch the affected systems or discontinue their use by October 11, 2026. That date is today; the reported federal requirement is not a deadline imposed on every organization.
Which five vulnerabilities and products are named?
The Hacker News reported on October 9, 2026, that CISA had added these five CVEs to the KEV catalog. The descriptions below reflect that report; exact affected versions and vendor remediation instructions are not established here.
As an Amazon Associate I earn from qualifying purchases.
| CVE | Product | Reported issue |
|---|---|---|
| CVE-2015-3306 | ProFTPD | Improper access control. |
| CVE-2021-3199 | ONLYOFFICE Docs | Path traversal associated with image-upload parameters when JWT is used. |
| CVE-2023-22894 | Strapi | Cleartext storage of sensitive information; the report describes user details being exposed through an admin-panel query filter. |
| CVE-2016-3081 | Apache Struts | Command injection associated with the method: prefix when Dynamic Method Invocation is enabled. |
| CVE-2015-5477 | ISC BIND | A reachable assertion vulnerability associated with TKEY queries that can cause denial of service. |
These are five separate issues in unrelated products, not one vulnerability with a shared patch. The two contemporaneous reports disagree on CVSS values for the Strapi and BIND entries, so those scores are not repeated here. A severity score would not, on its own, establish whether a particular deployment is exposed or how urgent remediation is in its local context.
What did federal agencies have to do by October 11?
0dayNews reported that the deadline applied to FCEB agencies under Binding Operational Directive 26-04: patch the vulnerabilities or discontinue use of the affected products by October 11, 2026. The available reporting does not establish a broader legal deadline for state and local governments, private companies, or individuals. Those organizations should treat the KEV additions as a risk signal and consult their own obligations and security policies rather than assume the federal directive applies to them.
#1 Best Overall
The precise affected versions and authoritative fixes for all five entries are not established in the cited coverage. Administrators should check the relevant vendor advisory and CISA’s KEV entry before choosing a version, patch, workaround, or retirement plan; do not infer that any installation is safe simply because its product name matches or differs from a reported example.
How should defenders review possible exposure?
- Inventory the five products. Search asset inventories, package and service records, cloud workloads, appliances, and externally hosted services for ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND. Include systems operated by contractors where your organization is responsible for their security.
- Confirm versions and configurations. For each match, record the installed version, relevant features or settings, network reachability, and whether the affected function is enabled. The reported issue descriptions point to possible conditions such as JWT use, Dynamic Method Invocation, or reachable TKEY queries; verify those conditions against vendor guidance rather than treating them as a complete test for exposure.
- Prioritize by real deployment risk. Consider internet exposure, reachability, business and operational criticality, exploit preconditions, available vendor remediation, and whether the system can be isolated or retired. Do not rank the five solely by conflicting reported CVSS values.
- Remediate and validate. Apply the vendor-confirmed fix or, where required, discontinue the affected product. If a fix is not immediately possible, use vendor- or CISA-supported mitigations and assess whether isolation can reduce exposure. Record the change and verify the deployed version or mitigation afterward.
- Review for signs of compromise. Because the issues were reported as exploited, patch status alone does not determine whether a system was previously accessed. Review relevant authentication, application, network, and endpoint records for suspicious activity, and escalate findings through your incident-response process.
What does the wider Flax Typhoon reporting add?
The Hacker News described these five issues as part of eight vulnerabilities associated with broader activity. Its summary of a joint advisory mentions scanning tools, cross-site scripting, password spraying against Microsoft Exchange, VPN persistence, and scripts used to exfiltrate emails and credentials. That is a report’s summary of the advisory, not a product-by-product finding about each of the five CVEs. For defenders, it is a reason to include identity, remote-access, and data-access review in incident triage where appropriate—not evidence that every vulnerable system experienced those techniques.
In an October 8, 2026 announcement, the U.S. Department of Justice said a court-authorized seizure targeted infrastructure and tools associated with Flax Typhoon and Integrity Technology Group. DOJ described Microscan as a reconnaissance and vulnerability-scanning tool used to identify networks for later exploitation. It described FishHub as facilitating spear phishing and said that, after an initial compromise, it could deliver malware for remote access or to search for and send files. DOJ reported approximately 20 Taiwanese universities as confirmed FishHub victims. These descriptions and victim figures are DOJ’s statements about the operation, not a measure of the number of organizations affected by the five CVEs.
DOJ’s announcement describes a disruption of associated infrastructure; that action does not establish that a potentially exposed network is clean. FBI Cyber Division Assistant Director Brett Leatherman said: “Integrity Technology Group provided China-linked threat actors with capabilities used to conduct widespread vulnerability scanning and, in some cases, intrusions targeting U.S. and foreign critical infrastructure.”
Quick Recap
Best Value
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
