The problem
On October 8, 2026, CISA added five vulnerabilities to the Known Exploited Vulnerabilities catalog in one update: ProFTPD, ISC BIND, Apache Struts, ONLYOFFICE Docs and Strapi. None of them was new. Two date from 2015. All five carried a three-day remediation deadline under BOD 26-04, and four were flagged for forensic triage.
The same day, the FBI-led joint advisory AA26-281A described activity by actors linked to Integrity Technology Group, using tactics consistent with what is tracked publicly as Flax Typhoon, and the Justice Department announced court-authorized seizures of domains supporting two of the group's tools.
A batch like this is easy to misread. Old CVEs feel solved, and a three-day clock pushes teams to patch first and ask questions later. Both instincts are wrong here.
What I did
I worked the batch from the catalog entries rather than the headlines, and wrote it up as a response plan.
- Read every field. Product, vulnerable condition, required action, due date, and the new forensic triage flag. The flag split the batch cleanly: the BIND bug causes denial of service, while the other four can give an attacker a foothold.
- Separate three questions. Is the product present? Is the vulnerable condition met and reachable? Was it already used? Struts is only exposed with Dynamic Method Invocation enabled, the ProFTPD issue lives in mod_copy, and the Strapi entry chains with CVE-2023-22621 for code execution. Presence alone does not set the priority.
- Map where it hides. FTP servers, DNS resolvers, legacy Java web apps, self-hosted document servers and headless CMS backends are exactly the systems that fall out of patch cycles. Software inventory finds them more reliably than network scans.
- Order the response. Find the assets, confirm reachability, preserve logs and hunt before patching where the triage flag says so, then patch, isolate or retire inside the window, and hand the SOC the relevant MITRE ATT&CK techniques to watch.
The outcome
The analysis turned a confusing batch into an ordered plan that a team could run inside the deadline, with clear owners for inventory, hunting and patching.
It also sharpened a point worth carrying into every KEV review: the catalog is not only about new CVEs. Between June 11 and October 16, 2026, 21 of the 131 vulnerabilities added to KEV carried CVE IDs from before 2026, and the oldest is from 2008. Age is not a mitigation. The full write-up walks through each CVE and the hunting steps.