On October 8, 2026, CISA added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog in a single update. The same day, the FBI led a joint advisory, AA26-281A, co-sealed by CISA, the NSA and international partners. It describes how actors linked to Integrity Technology Group build tools, host infrastructure and break into networks, using tactics consistent with the activity tracked publicly as Flax Typhoon. The Justice Department also announced court-authorized seizures of domains supporting two of those tools: MicroScan, a vulnerability scanner, and FishHub, a spear phishing tool.
The KEV side of that news is easy to skim past, because none of the five CVEs is new. Here is what was actually added.
| CVE | Product | What it allows | Forensic triage |
|---|---|---|---|
| CVE-2015-3306 | ProFTPD | Remote file read and write through the mod_copy SITE CPFR and SITE CPTO commands | Yes |
| CVE-2015-5477 | ISC BIND | Denial of service through crafted TKEY queries | No |
| CVE-2016-3081 | Apache Struts | Command injection when Dynamic Method Invocation is enabled | Yes |
| CVE-2021-3199 | ONLYOFFICE Docs | Path traversal in an image upload parameter, leading to code execution | Yes |
| CVE-2023-22894 | Strapi | Admin panel users can expose sensitive user details through query filters; chains with CVE-2023-22621 for code execution | Yes |
All five carry a due date of October 11, 2026: three days after they were added.
What the KEV fields are telling you
Since BOD 26-04 took effect in June, a KEV entry carries more signal than a due date. Two fields matter here.
The three-day window. BOD 26-04 replaced the old one-clock-fits-all KEV rule with remediation windows based on risk: whether the asset is publicly exposed, whether exploitation can be automated, how much control a successful exploit gives, and whether there is evidence of active exploitation. Three days is the top tier.
The forensic triage flag. Four of the five entries are marked for forensic triage. The exception is the BIND bug, which can knock a resolver over but does not hand an attacker a foothold. That split is the useful part. For the other four, a patch closes the door, but it does not tell you whether someone already walked through it.
Why old CVEs still matter
A 2015 FTP bug sounds like a museum piece. But public reporting on the advisory describes a pattern that makes old bugs dangerous: AI-assisted scanning and large botnets to find targets, followed by hands-on-keyboard exploitation of whatever is still exposed.
Old, forgotten services are exactly what that kind of scanning finds. A file server nobody remembers deploying. A Struts application that predates the current team. A document server stood up for one project and never retired. Age is not a mitigation. If anything, it is a sign that the asset has fallen out of everyone's patch cycle.
How I would work the batch
- Find it. Search the asset inventory and scanner data for each product, including the places scanners miss: appliances, vendor-managed systems, containers built from old base images and anything in a forgotten cloud account. Software inventory beats network scans for libraries like Struts and self-hosted apps like Strapi.
- Check the exploit conditions. Struts is only exposed with Dynamic Method Invocation enabled. The ProFTPD issue lives in mod_copy. The Strapi entry chains with CVE-2023-22621. A finding that does not meet the condition is lower risk; one that does, on an internet-facing host, goes to the top of the queue.
- Hunt before you patch, where the flag says so. For the four flagged entries, preserve logs first and look for signs of earlier use: unexpected files written over FTP, new or modified files in web application directories, unusual admin API activity against Strapi. Patch once you have captured what you need.
- Patch, isolate or retire inside the window. Fixes for all of these have existed for years. Some instances will be end-of-life and need to be retired or isolated instead. Any exception gets an owner, a compensating control and an expiry date.
- Tell the SOC what to watch. Map the activity to MITRE ATT&CK. Exploitation of public-facing applications (T1190) and web shells (T1505.003) are the obvious techniques, and the FishHub seizure is a reminder that spear phishing (T1566) runs alongside the exploitation.
The takeaway
The October 8 batch is a reminder that threat-informed prioritization is not only about what is new. The catalog's own data says so: of the 131 vulnerabilities added to KEV between June 11 and October 16, 2026, 21 carry CVE IDs from before 2026, and the oldest is from 2008. I looked at that whole period in KEV under BOD 26-04.
The question for any team is not "did we patch 2015?" It is "do we know every place 2015 is still running?"
Sources
- CISA Known Exploited Vulnerabilities catalog
- CISA KEV data on GitHub (catalog version 2026.10.16)
- CISA BOD 26-04: Prioritizing Security Updates Based on Risk
- BOD 26-04 implementation guidance and forensic triage requirements
- CISA cybersecurity advisories (search for AA26-281A)
- Apache Struts security bulletin S2-032 (CVE-2016-3081)
- MITRE ATT&CK T1190: Exploit Public-Facing Application