CISA adds five legacy flaws to KEV catalog with 11 October deadline
On 8 October 2026 CISA added five flaws to its Known Exploited Vulnerabilities catalog — in ISC BIND, ProFTPD, Apache Struts, ONLYOFFICE Docs and Strapi — with a remediation deadline of 11 October. Four entries carry a forensic-triage flag, and fixes for most have existed since 2015–2021. The same day the FBI, CISA and NSA issued joint advisory AA26-281A on China-linked actors, and the DOJ seized seven domains hosting the MicroScan scanner and FishHub malware delivery tool.
- CISA added 5 flaws to KEV on 8 October, deadline 11 October 2026
- Affected: ISC BIND, ProFTPD, Apache Struts, ONLYOFFICE Docs, Strapi
- Four entries require forensic triage for signs of compromise
- DOJ seized 7 domains hosting MicroScan scanner and FishHub loader
Read next
Security