On October 8, 2026, CISA added five old CVEs to its KEV catalog, all with an October 11 due date. The oldest is from 2015, the newest from 2023. None of them is new, and that's exactly why they deserve attention.
The KEV catalog doesn't list flaws that are dangerous in theory. It lists the ones CISA has evidence of active exploitation for. A 2015 CVE entering it today means attackers still find it exploitable somewhere. Put differently: servers unpatched for a decade are still answering on the internet.
| CVE | Product | Nature (KEV entry) | KEV added | Due |
|---|---|---|---|---|
| CVE-2015-3306 | ProFTPD | Improper access control (mod_copy) | 2026-10-08 | 2026-10-11 |
| CVE-2021-3199 | ONLYOFFICE Docs | Path traversal, possible RCE | 2026-10-08 | 2026-10-11 |
| CVE-2023-22894 | Strapi | Cleartext storage of sensitive data | 2026-10-08 | 2026-10-11 |
| CVE-2016-3081 | Apache Struts | Command injection (DMI) | 2026-10-08 | 2026-10-11 |
| CVE-2015-5477 | ISC BIND | Denial of service via TKEY queries | 2026-10-08 | 2026-10-11 |
The export used for this article provides no CVSS score or version boundaries for these five CVEs, so I'm not quoting any. Check each NVD entry and the vendor advisories for the release to install.
ProFTPD — CVE-2015-3306
ProFTPD's mod_copy module adds server-side file copy commands. Per the KEV entry, the flaw lets a remote attacker read and write arbitrary files through those commands. Writing a file into the document root of a web server hosted on the same machine is enough to get code execution.
Where to look: old appliances, NAS devices, shared hosting servers, distribution images that were never updated.
Mitigation: update ProFTPD per the project's advisory, and disable mod_copy if you don't use it — you rarely do. Better still: ask whether that FTP service should still exist.
ONLYOFFICE Docs — CVE-2021-3199
The KEV entry describes a path traversal in ONLYOFFICE Docs, reachable when JWT is in use, through an image upload parameter, and potentially leading to remote code execution.
Where to look: document servers set up for a collaboration suite (often paired with Nextcloud or a document management system) and never updated since.
Mitigation: update ONLYOFFICE Docs per the vendor advisory, and don't expose the document server directly to the internet if it only serves an intranet.
Strapi — CVE-2023-22894
A widely used headless CMS. The KEV entry describes cleartext storage of sensitive information: an attacker with access to the admin panel can discover sensitive user details through query filters. Two CISA notes change how to read it:
- the flaw can be chained with CVE-2023-22621 to achieve remote code execution;
- the affected products could be end-of-life (EoL/EoS), and CISA advises discontinuing use or moving to a supported version.
Mitigation: move to a Strapi version the vendor supports, address CVE-2023-22621 at the same time, restrict the /admin panel to admin networks, and rotate the instance's API secrets and tokens.
Apache Struts — CVE-2016-3081
A remotely exploitable command injection when Dynamic Method Invocation (DMI) is enabled, per the KEV entry. Struts powers many internal Java applications from the 2010s: intranets, line-of-business portals, tools delivered by integrators.
Where to look: older Java applications, often bundled inside a third-party product. The Struts library lives in the WAR, not necessarily in your software inventory.
Mitigation: update Struts per the Apache advisory, and disable DMI in the application configuration if it doesn't rely on it. If the application comes from a vendor, ask them for a fixed release.
ISC BIND — CVE-2015-5477
A flaw in handling TKEY queries lets a remote attacker cause a denial of service — the DNS server stops. No code execution, but when DNS goes down, everything depending on it follows: mail, authentication, internal resolution.
Where to look: authoritative DNS servers on old distributions, network appliances embedding BIND, forgotten internal resolvers.
Mitigation: update BIND per the ISC advisory, and make sure recursive resolvers aren't open to the internet.
Common Detection
- Real inventory: scan your exposed ranges for these five services rather than only querying the CMDB. Forgotten instances are precisely the ones missing from it.
- Recent files in web or FTP trees with no matching deployment
- Unexpected child processes of Java servers (Struts) or the document server
- Unexplained restarts of the DNS service
- Strapi admin panel logins from unusual addresses
Mitigation, in Priority Order
- List every instance of these five products, internal and exposed.
- Update or retire: for a 2015 CVE still present, the real question is often why the service still exists.
- Cut exposure of interfaces that don't need to be public (Strapi admin, FTP, document server).
- Disable unused features: mod_copy in ProFTPD, DMI in Struts.
- If exploitation is suspected: treat the machine as compromised and rotate the secrets it holds.
Why Continuous Monitoring of Your Estate, Old Parts Included, Matters
These five CVEs have been fixed for years. If they're exploited today, the inventory has lost track of some machines. A watch process that only looks at new CVEs misses this case: you also need to match KEV additions against what actually runs.
With cveo.tech, register your estate with versions, old servers included, and get alerted as soon as a CVE affecting it enters the KEV catalog.